The osv/index.php?r=students/guardians/create id parameter in Open-School 3.0 and Community Edition 2.3 is vulnerable to XSS.
osv/index.php?r=students/guardians/create