A cross‑site scripting flaw exists in the PHPEMS 11.0 application, triggered by manipulating the 'askcontent' parameter in the /index.php?ask=app-ask endpoint. The vulnerability allows an attacker to inject and execute arbitrary script code within the context of a victim’s browser, potentially leading to session hijacking, defacement, or credential theft. The weakness is a classic reflected XSS, classified under CWE‑79, and is exposed through a remote attack vector.

The affected system is the PHPEMS e‑learning platform version 11.0. The flaw resides in the index.php script that processes the 'askcontent' input. Only installations running PHPEMS 11.0 or earlier are vulnerable; any newer release that removes or sanitises this input is presumed safe.

The CVSS base score of 5.1 reflects moderate severity. The EPSS score of less than 1 % indicates a low probability that the vulnerability has been widely exploited in the wild, and it is not listed in the CISA KEV catalog, so no known field‑invasive exploits have been reported. Nonetheless, the flaw is publicly documented and exploitable by anyone with network access to the web server, requiring no authentication or special privileges. An attacker can craft a URL containing malicious code in the askcontent value, cause the target user’s browser to execute it, and then proceed with secondary attacks if privileged information is captured.