The vulnerability is a stored cross‑site scripting flaw in the SourceCodester Ship Ferry Ticket Reservation System. The username field in the /admin/?page=user/manage_user handler accepts user input that is saved without proper sanitization, and the value is later rendered in the web interface. As a result, an attacker who can supply a crafted username can inject JavaScript that executes whenever the stored value is displayed.

The affected product is SourceCodester Ship Ferry Ticket Reservation System version 1.0. No additional versions are mentioned in the CVE entry.

The CVSS score of 4.8 indicates moderate severity. The EPSS data is not available, so the exact likelihood of exploitation cannot be quantified, but the vulnerability is publicly disclosed and may be used remotely via the /admin interface. Based on the description, it is inferred that an attacker would need to submit a malicious username via the admin page; whether authentication is required is not stated and thus remains unknown. The flaw is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild.