The flaw exists in the clean function of searchresults.php in SourceCodester Simple Student Information System 1.0. By supplying a crafted value through the searchbox query parameter, an attacker can inject arbitrary script into the page. The injected script is executed in the victim’s browser context, producing a cross‑site scripting vulnerability. This weakness is represented by CWE‑79, and the CNA also lists CWE‑94 as a related weakness, although the vulnerability description does not explicitly mention code execution or the associated risk.

The affected product is SourceCodester Simple Student Information System, version 1.0, supplied by SourceCodester. All installations that include a searchresults.php module and use the clean function exposed to user input are susceptible. No other versions were explicitly listed as affected in the available data.

The vulnerability received a CVSS score of 5.1, indicating moderate overall severity. EPSS data is not available, and the issue has not been cataloged in CISA’s KEV list. Attackers can launch the exploit remotely by crafting a malicious searchbox value and directing a victim’s browser to the vulnerable script. Because it can be triggered by any user who visits the page with the payload, the risk of exploitation remains significant in environments exposed to the internet.