This vulnerability involves a cross-site scripting flaw in the yashpokharna2555 StudentManagementSystem, specifically in the /student.php file's FIRST_NAME parameter. An attacker can remotely manipulate this parameter to execute arbitrary scripts in the context of the victim's browser. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity. No official patch or remediation level is currently available, and the vendor has not responded to the initial report. The continuous delivery model complicates version tracking for affected or fixed releases.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of users interacting with the vulnerable parameter, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires low attack complexity and no privileges but does require user interaction. There is no indication of direct impact on confidentiality, integrity, or availability beyond the XSS scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or vendor response is available, users should consider implementing input validation and output encoding on the FIRST_NAME parameter as a temporary mitigation. Monitoring for updates from the vendor is recommended.