An input field named Name in the complaint.php script of projectworlds House Rental and Property Listing 1.0 can be manipulated to inject malicious script. The injected code is reflected in the browser, enabling an attacker to execute arbitrary JavaScript in the context of any user who visits the affected page. This compromise could lead to session hijacking, credential theft, or defacement of the application.

The vulnerability affects the projectworlds House Rental and Property Listing application version 1.0. No additional vendor or product details were provided beyond the CNA designation.

The CVSS score of 4.8 places this issue in the moderate risk category. The EPSS score is reported as less than 1 %, indicating a very low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. However, the exploit is publicly available, and attackers could launch it remotely by crafting a malicious request to complaint.php. Since no official patch is disclosed, the primary risk remains until the vendor releases a fix or the attacker successfully abuses the flaw.