Is CVE-2025-65134 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-65134 being exploited in the wild.

How severe is CVE-2025-65134?

Medium severity, with a CVSS score of 6.1, published 14 April 2026.

Which products and versions are affected?

Manikandan580 School Management System 1.0.

Is there a fix for CVE-2025-65134?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-65134 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-65134?

Check whether you run Manikandan580 School Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-65134: manikandan580 School-management-system XSS in contact-us.php

CVE-2025-65134 · Severity: medium · CVSS 6.1 · Published 2026-04-14

A security vulnerability exists in the manikandan580 School Management System, a platform used for managing educational institution data. An attacker can trick an administrator into executing malicious code within their web browser by sending a specially crafted web request. If successful, this could allow the attacker to hijack administrative sessions, steal sensitive information, or perform unauthorized actions on behalf of the administrator.

Technologies: Manikandan580 School Management System. Vendors: Manikandan580.

Quick answers

Is CVE-2025-65134 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-65134 being exploited in the wild.
How severe is CVE-2025-65134?: Medium severity, with a CVSS score of 6.1, published 14 April 2026.
Which products and versions are affected?: Manikandan580 School Management System 1.0.
Is there a fix for CVE-2025-65134?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-65134 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-65134?: Check whether you run Manikandan580 School Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the /studentms/admin/contact-us.php endpoint of the School-management-system version 1.0. The root cause is the improper neutralization of user-supplied input, specifically the 'email' POST parameter, which is reflected back into the HTML response without adequate sanitization or output encoding (e.g., failing to use htmlspecialchars). An unauthenticated remote attacker can exploit this by inducing an administrator to submit a crafted request. Successful exploitation allows the execution of arbitrary JavaScript in the context of the administrator's browser session, potentially leading to session cookie theft or unauthorized administrative actions. Mitigation involves implementing strict output encoding and server-side input validation.

Affected products

manikandan580 School-management-system 1.0

Timeline

2026-04-14: disclosed: Initial CVE publication
2026-05-10: advisory: CISA-ADP enrichment and CVSS assessment

References

https://github.com/TREXNEGRO/Security-Advisories/blob/main/CVE-2025-65134/README.md

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.