A flaw in the Profile Field Handler component of SourceCodester Simple Student Information System version 1.0 allows an attacker to inject scripts through the firstname and lastname arguments passed to /register.php. The vulnerability is a classic cross‑site scripting (CWE‑79) and may also involve code injection (CWE‑94) in the processing of these parameters. When triggered, a malicious script can execute in the context of the victim’s browser, potentially leading to session hijacking, data theft, or defacement. The CVE notes that the attack may be initiated remotely and that exploitation code is publicly available, indicating that the flaw is actively usable.

The vulnerability impacts SourceCodester Simple Student Information System version 1.0.

The vulnerability receives a CVSS score of 5.3, denoting a medium severity. EPSS data is not available, but the existence of publicly available exploitation code suggests that adversaries can exploit it without sophisticated tooling. The flaw is not listed in the CISA KEV catalog. The attack vector appears to be remote, relying on a crafted HTTP request to /register.php. Because the vulnerability is easy to trigger and the payload is flexible, the risk to users of the affected version is significant enough to warrant prompt review and remediation.