It identifies a cross‑site scripting vulnerability in the admin user management endpoint of the Online Reviewer System. An attacker that can control the ‘firstname’ parameter can inject arbitrary script code into the page returned by btn_functions.php, enabling the execution of malicious JavaScript in the context of an authenticated admin or any user that views the page.

The affected software is code‑projects Online Reviewer System version 1.0. The vulnerability resides in the file system/system/admins/manage/users/btn_functions.php and can be triggered by sending a crafted ‘firstname’ argument to that endpoint. Only this single version is enumerated as vulnerable; other versions have not been reported as affected.

The CVSS score of 4.8 indicates a moderate impact, and the EPSS value below 1 % suggests a low likelihood of exploitation at the time of publication. The vulnerability is remote and publicly exploitable, as attackers can visit the vulnerable admin page from the internet. Because the flaw permits arbitrary script execution, it could be used for session hijacking, defacement, or data theft. The vulnerability is not currently listed in CISA’s KEV catalog, but it remains a relevant threat for organizations running the unpatched 1.0 release.