CVE-2025-65134

CVE-2025-65134 is a reflected cross-site scripting (XSS) vulnerability identified in School-management-system version 1.0 by manikandan580, specifically affecting the contact-us.php page in the admin module through improper handling of the email POST parameter. This vulnerability allows attackers to inject malicious scripts that execute in users' browsers when they interact with the vulnerable endpoint. The attack requires user interaction (reflected XSS) and involves minimal complexity, making it relatively straightforward to exploit. However, the potential impact is limited to session hijacking, credential theft, or malware distribution among administrators and users who access the vulnerable page. The low EPSS score of 0.00024 indicates minimal real-world exploitation likelihood relative to other known vulnerabilities. There is currently no evidence of active exploitation in the wild, no public exploit code availability, and minimal community attention to this vulnerability. The vulnerability is not tracked on the KEV catalog and remains inactive on exploit tracking platforms, suggesting a low priority for immediate remediation relative to other cybersecurity threats. Organizations using this application should apply available patches or implement input validation controls as part of routine vulnerability management.