This vulnerability involves a cross-site scripting flaw in the Cyber-III Student-Management-System, specifically in the Class Schedule Deletion Endpoint's handling of the 'batch' parameter. An attacker can remotely manipulate this parameter to inject and execute malicious scripts in the context of the affected web application. The vulnerability is present in the version identified by commit 1a938fa61e9f735078e9b291d2e6215b4942af3f. The vendor has not issued any patch or official remediation, and the product lacks versioning, making it difficult to determine the full scope of affected instances. The vulnerability has been publicly disclosed but is not known to be exploited in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser when interacting with the affected endpoint. This may lead to session hijacking, defacement, or other client-side attacks. However, the impact is limited to the scope of the XSS vulnerability and does not include privilege escalation or direct system compromise. The CVSS score of 5.3 reflects a medium severity, indicating moderate risk.

No official fix or patch is currently available from the vendor, and the vendor has not responded to the issue report. Users should exercise caution when using the affected endpoint and consider implementing web application firewall (WAF) rules to detect and block malicious input targeting the 'batch' parameter. Additionally, input validation and output encoding should be applied as a temporary mitigation if possible. Monitor vendor channels for any future updates or patches addressing this vulnerability.