This vulnerability in igweze wizgrade up to commit b1d55f22b90cd7e7a6e5002f006d7c649e8086d6 affects an unknown portion of the code in dashboard/studentConductManager.php, leading to cross-site scripting (CWE-79). The attack can be performed remotely without privileges or user interaction, with low complexity. The product's rolling release model means version-specific information is not provided. The vendor was contacted but did not respond, and no official remediation or patch is available. The CVSS 4.0 base score is 5.3 (medium severity).

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other malicious actions. The vulnerability does not require privileges or user interaction but has limited impact due to the medium severity score. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider applying input validation or output encoding workarounds if feasible. Monitor official vendor channels for updates or patches. Avoid relying on generic mitigations unless directly applicable.