The issue is a reflected cross‑site scripting flaw within the /account.php page of the Online Examination System. When the query string is crafted with a malicious value for the parameter 'q', the application outputs the input without proper sanitization or encoding. This allows an attacker to inject arbitrary JavaScript that runs in the browser of any user who visits the affected URL, potentially exfiltrating credentials or launching other client‑side attacks. The flaw is not a code‑execution vulnerability on the server side and does not directly grant system access.

The vulnerability was identified in code‑projects’ Online Examination System, specifically in version 1.0. No other versions or products were listed as affected.

The CVSS score of 5.3 indicates a moderate impact and the low EPSS of less than 1% suggests that exploitation is unlikely at present, although the flaw is publicly documented and can be triggered remotely by simply visiting a crafted URL. It is not listed in the CISA KEV catalog. Attackers could exploit the vulnerability by manipulating the 'q' query parameter to embed malicious scripts; no additional credentials or local access are required.