What is the CVSS score of CVE-2025-65134?

CVE-2025-65134 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

School Management System CVE-2025-65134

EUVD-2025-209445 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-14 mitre

GHSA-mww8-x95w-rh7p

XSS PHP N A

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 10, 2026 - 21:22 vuln.today

CVSS changed

May 10, 2026 - 21:22 NVD

6.1 (MEDIUM)

EUVD ID Assigned

Apr 14, 2026 - 16:00 euvd

EUVD-2025-209445

CVE Published

Apr 14, 2026 - 00:00 nvd

N/A

CVE Published

Apr 14, 2026 - 00:00 nvd

MEDIUM 6.1

DescriptionCVE.org

In manikandan580 School-management-system 1.0, a reflected cross-site scripting (XSS) vulnerability exists in /studentms/admin/contact-us.php via the email POST parameter.

AnalysisAI

Reflected cross-site scripting (XSS) in School Management System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the email POST parameter in the contact-us.php admin interface. A victim must click a crafted link, enabling attackers to steal session cookies, perform administrative actions, or redirect users to malicious sites. Public proof-of-concept code exists; however, real-world exploitation probability remains low (EPSS 0.02%) due to reliance on user interaction and limited automaton.

Technical ContextAI

The vulnerability occurs in /studentms/admin/contact-us.php, a PHP-based contact form handler within the School Management System application. The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) indicates that user-supplied input from the email POST parameter is reflected directly into the HTTP response without proper sanitization or output encoding. This allows attackers to break out of the intended HTML context and inject arbitrary JavaScript code that executes in the victim's browser with the privileges of their session. The vulnerability is classified as reflected XSS because the malicious payload must be delivered to the victim and is not stored persistently on the server.

RemediationAI

The primary remediation is to upgrade to a patched version of School Management System; however, no specific patched version number is provided in the available advisory data. Contact the vendor (manikandan580 on GitHub) or check the repository for a newer release. As an immediate workaround, implement output encoding on the email parameter using HTML entity encoding (e.g., PHP's htmlspecialchars() or htmlentities() with ENT_QUOTES flag) before reflecting user input into the response. Additionally, apply input validation to enforce a strict email format and reject payloads containing characters typical of XSS attacks (angle brackets, quotes, semicolons). If the contact form is not actively used, disable the /studentms/admin/contact-us.php endpoint via web server configuration (Apache/nginx) or .htaccess rules to prevent exploitation entirely. Implement Content Security Policy (CSP) headers with strict-dynamic and nonce-based inline script policies to limit the blast radius if XSS is exploited. These mitigations reduce the attack surface while awaiting a patched release.