The vulnerability is a cross‑site request forgery flaw in the SourceCodester Medical Certificate Generator App 1.0, classified as CWE‑352 and also exposing an access‑control weakness (CWE‑862). The flaw allows an attacker to craft a page that automatically submits a request to the application while a victim has an active authenticated session, leading to deletion or manipulation of medical certificate records without the user’s consent. The problem is remotely exploitable; the exploit is publicly disclosed and can be used by any actor that can lure a logged‑in user to a malicious site.

SourceCodester’s Medical Certificate Generator App version 1.0. No other products or versions are mentioned as affected in the CNA data.

The CVSS base score of 5.3 indicates moderate severity, while the EPSS score of less than 1 % suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread attacks. Exploitation requires a victim to be logged into the application at the time the malicious page is visited, making the attack somewhat opportunistic but still dangerous if users regularly access the app from shared or public devices.