The vulnerability resides in the /admin/remove‑user.php endpoint of code‑projects Assessment Management 1.0. By manipulating the ID query argument, an attacker can cause the application to output unescaped data, producing a reflected cross‑site scripting (XSS) response. The CVE lists both CWE‑79 (XSS) and CWE‑94 (code injection). While the advisory describes reflected XSS, the presence of CWE‑94 indicates that the ID value may be incorporated into server‑side PHP code in a manner that could, in theory, allow code injection if exploited under the right conditions. This dual classification underscores the importance of robust input validation and context‑aware escaping for the ID parameter.

The only product explicitly affected is code‑projects Assessment Management version 1.0. All installations exposing the /admin/remove‑user.php path without the vendor patch are potentially vulnerable. No additional products, modules, or versions are mentioned in the advisory.

The CVSS v3.1 score of 5.3 signals moderate severity. The EPSS score of < 1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet achieved widespread exploitation. Attackers can trigger the flaw remotely by sending a crafted HTTP GET request that includes a malicious ID value to the vulnerable endpoint; no authentication or privileged access is required beyond being able to reach the application. The potential for server‑side code injection (as implied by CWE‑94) remains unconfirmed, but it elevates the risk assessment if an application developer inadvertently routes the ID into executable PHP code.