This vulnerability in imvks786 student_management_system allows remote attackers to execute cross-site scripting attacks by manipulating the name, address, or fname arguments in the /add.php file. The vulnerability has a CVSS 4.0 base score of 5.1 (medium severity) with network attack vector, low attack complexity, no privileges required, and user interaction needed. The product uses rolling releases, so no explicit affected or fixed versions are identified. The vendor has been informed but has not issued a patch or official remediation guidance.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability requires user interaction and low privileges, limiting its impact to scenarios where users visit a crafted URL or submit malicious input. No evidence of known exploits in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should apply standard XSS mitigations such as input validation and output encoding on the affected parameters (name, address, fname) in /add.php. Monitor vendor channels for updates and patches.