A data‑validation flaw in the /social/ajax.php?action=save_upload endpoint of SourceCodester Photo Share Website allows an attacker to inject arbitrary script payloads through the content parameter. This flaw is a classic cross‑site scripting vulnerability (CWE‑79) and also involves unsafe code evaluation (CWE‑94). Because the content field is rendered client‑side without proper encoding, an attacker can execute scripts in the victim’s browser, potentially leading to data theft, session hijacking, or defacement.

SourceCodester Photo Share Website version 1.0 is affected. The CVE references a comment input box component, and the known product is listed as SourceCodester:Photo Share Website. No sub‑versions are provided, so any instance running 1.0 could be vulnerable if the ajax.php file has not been patched.

The CVSS score of 5.1 indicates a medium risk. The exploit is publicly available, and the attack can be launched remotely through the web interface. EPSS is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that without access controls preventing injection, the flaw could be leveraged by any authenticated or unauthenticated user who can submit content, making the threat surface quite broad.