The flaw in save‑games.php permits attackers to inject malicious scripts through the game_name argument. This leads to cross‑site scripting, which can be used to hijack user sessions, deface content, or execute further client‑side attacks. The CVE notes that the exploit has been publicly released and attackers can trigger it from remote hosts.

The affected application is Campcodes Division Regional Athletic Meet Game Result Matrix System, version 2.1. The vulnerability resides in an unknown section of the file save‑games.php; a security patch is required to remove the attack surface.

The base exploit score of 5.1 reflects a moderate impact. The EPSS score of less than 1 % suggests low current exploitation likelihood, but the vulnerability is publicly known and may be leveraged arbitrarily. The attack vector is inferred to be network‑based, with the threat of remote exploitation.