This vulnerability involves improper sanitization of the $_SERVER['PHP_SELF'] variable in the Admin Add Endpoint of the Cyber-III Student-Management-System, leading to cross-site scripting. An attacker can remotely exploit this by manipulating the URL to inject malicious scripts, potentially affecting users who access the vulnerable page. The product uses rolling releases, so specific patched versions are not identified, and no official remediation has been announced. Exploit code is publicly available, but no known exploitation in the wild has been reported.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, which can lead to session hijacking, defacement, or other client-side impacts. The vulnerability requires user interaction and privileges to access the admin endpoint. There is no indication of server-side compromise or data breach from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider applying manual input validation or sanitization on the $_SERVER['PHP_SELF'] variable as a temporary mitigation. Restricting access to the affected admin endpoint and monitoring for suspicious activity may also help reduce risk until an official fix is available.