This vulnerability in Cyber-III Student-Management-System up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f allows remote attackers to perform cross-site scripting via manipulation of the $_SERVER['PHP_SELF'] variable in the /admin/Add notice/notice.php endpoint. The vulnerability enables injection of malicious scripts due to insufficient sanitization of this input. The product uses rolling releases, and no official patch or remediation guidance has been published by the vendor as of the report date.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. However, the impact is limited to the scope of the XSS vulnerability and does not include privilege escalation or server compromise. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider applying manual input validation or sanitization on the affected parameter as a temporary mitigation. Avoid exposing the vulnerable endpoint to untrusted users until a fix is available.