The Zoo Management System version 1.0 contains a reflected cross‑site scripting flaw in its login page. An attacker can embed malicious JavaScript into the msg query parameter, which the application echoes back without proper encoding or sanitization. When an unsuspecting user visits the crafted URL, the script executes in their browser, enabling the attacker to steal credentials, deface the interface, or perform other client‑side attacks. This weakness corresponds to CWE‑79, a classic input validation error that compromises confidentiality and integrity on the client side.

The vulnerability is limited to SourceCodester Zoo Management System version 1.0. No other vendors or product variants are reported to be affected.

The base score of 6.1 indicates a moderate severity, while the EPSS score is below 1 %, suggesting a relatively low probability of widespread exploitation. However, the flaw can be triggered simply by visiting a malicious link without requiring authentication or elevation of privileges, making it attractive to attackers who can distribute spam or phishing campaigns. The lack of an in‑vendor patch at the time of discovery means unpatched systems remain vulnerable until an update is released.