CVE-2025-65136 Details

A reflected cross-site scripting vulnerability has been identified in Manikandan580's School Management System version 1.0. The issue resides in the contact-us.php file within the admin directory, specifically through the pagedes POST parameter. This vulnerability allows an attacker to inject a script that is executed in the administrator's browser.

To address this vulnerability, output encoding should be applied by using htmlspecialchars() before displaying any user-supplied data in a textarea. Additionally, input sanitization should be implemented to remove HTML tags from description fields before saving or displaying them. A strict Content Security Policy should be adopted to block the execution of inline scripts, and admin session cookies should be configured with HttpOnly and SameSite attributes to mitigate the risk of cookie theft.