A reflected cross‑site scripting flaw exists in the login page of the SourceCodester Zoo Management System. The "msg" query parameter is rendered back to the user without HTML encoding or sanitisation, which lets an attacker inject arbitrary script or markup into the page. The impact is that the injected code will execute in the context of the victim’s browser. The potential consequences – such as session hijacking, credential theft, or site defacement – are inferred from the nature of XSS and are not directly stated in the CVE description.

The vulnerability affects the SourceCodester Zoo Management System version 1.0 as distributed by SourceCodester. No other vendors or versions are mentioned in the CVE entry.

The CVSS score of 6.1 indicates moderate severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a specially crafted URL containing malicious content in the "msg" parameter and a victim who follows that link. The attack vector is remote and does not require local access or elevated privileges.