A flaw exists in the Lesson Module Handler of SourceCodester E‑Learning System 1.0, specifically in /admin/modules/lesson/index.php. The vulnerability allows an attacker to supply malicious content in the Title or Description parameters, causing a basic cross‑site scripting (XSS) response that is rendered to users who view the lesson page. The attack can be performed remotely by sending the crafted input to the web application, and an exploit has already been published and may be in use.

The affected product is SourceCodester E‑Learning System version 1.0. The vulnerability resides in the admin lesson index handler, which is part of the Lesson Module Handler component. Any deployment of this version that exposes the admin lesson interface is potentially vulnerable.

The CVSS base score of 5.3 indicates a moderate severity; the EPSS score of less than 1% suggests a low but non‑zero probability of exploitation at this time. The entry is not listed in the CISA KEV catalog. The issue is exploitable remotely via the web front‑end, and a successful XSS attack could enable session hijacking, defacement, or phishing attacks against users who load the compromised lesson page. No additional prerequisites beyond access to the book's administrative interface are required beyond sending the malicious payload.