The vulnerability resides in the index.php file of itsourcecode Fees Management System 1.0. An attacker can manipulate the `page` argument to inject script code that is rendered in the browser, enabling client‑side code execution. This allows theft of user data, session hijacking, and phishing attacks. The weakness is a reflected XSS flaw (CWE‑79) with potential for code injection via parameter handling (CWE‑94).

The affected product is itsourcecode Fees Management System, version 1.0. No other versions are listed as vulnerable in this advisory.

The public exploit is available and can be launched remotely from the Internet. The CVSS score of 5.3 indicates a moderate impact and moderate complexity. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, but the presence of an accessible exploit elevates the risk. The attack surface is limited to users interacting with index.php on the affected web server with a crafted `page` value.