This vulnerability affects QDOCS Smart School Management System versions 7.0 through 7.2. It involves a cross-site scripting flaw in the Admission Enquiry Module, specifically in an unknown function of the /admin/enquiry file. By manipulating the 'Note' parameter, an attacker can inject and execute arbitrary scripts in the context of the affected application. The vulnerability is remotely exploitable and requires low privileges with user interaction possible. The CVSS 4.0 base score is 5.1, indicating a medium severity level.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. However, the impact is limited by the requirement of low privileges and possible user interaction. There is no indication of further privilege escalation or direct system compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply input validation and output encoding on the 'Note' parameter in the Admission Enquiry Module to mitigate XSS risks. Monitor vendor channels for updates and apply patches promptly once released.