School Management System PHP version 1.0 contains a Cross Site Scripting (XSS) vulnerability in the /login.php page via the password parameter. This vulnerability allows an attacker to inject malicious scripts that could be executed in the context of a user's browser session. The vulnerability has a medium severity rating with a CVSS score of 5.4.