This vulnerability involves a cross-site scripting issue in the Cyber-III Student-Management-System up to commit 1a938fa61e9f735078e9b291d2e6215b4942af3f. The flaw exists in the Class Schedule Deletion Endpoint, where improper handling of the 'batch' parameter allows an attacker to inject malicious scripts. The attack vector is network accessible with no privileges required, but user interaction is necessary. The vulnerability is confirmed public but lacks vendor response or patch availability. The product does not use versioning, complicating identification of affected releases beyond the specified commit.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or other malicious actions within the affected web application. The CVSS 4.0 base score is 5.3 (medium severity), reflecting the remote attack vector and requirement for user interaction. There are no reports of active exploitation in the wild.

No official patch or remediation is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a fix is provided, consider applying web application firewall (WAF) rules to detect and block suspicious input targeting the 'batch' parameter in the /admin/class schedule/delete_batch.php endpoint. Avoid exposing this endpoint to untrusted users where possible.