A flaw in the Books_Manager application’s add_book_check.php controller allows an attacker to supply a crafted "mark" value that is rendered without proper sanitization, resulting in injected JavaScript that executes in the victim’s browser. This is a client‑side injection (CWE‑79) that can be leveraged to steal session cookies, deface content, or deliver secondary malware, but it does not provide direct access to the server.

The vulnerability affects any deployment of iJason‑Liu Books_Manager that contains the code matching or preceding the commit hash 298ba736387ca37810466349af13a0fdf828e99c. Because the product does not use a conventional versioning scheme, it is unclear whether subsequent revisions have addressed the flaw, so administrators should assume the vulnerability persists until confirmed otherwise.

The CVSS score of 4.8 indicates low severity, yet the flaw can be exploited remotely without authentication and is publicly disclosed. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, implying no large‑scale attacks yet. Nevertheless, remote attackers could target any unauthenticated user visiting the vulnerable page to execute malicious scripts, and the lack of an official vendor patch requires manual mitigations.