This vulnerability arises from improper handling of the a_name argument in Campcodes Division Regional Athletic Meet Game Result Matrix System 2.1, allowing arbitrary JavaScript injection through the save_up_athlete.php script. The flaw can be triggered by an attacker sending a crafted request to the application, causing the browser to execute malicious code in the context of legitimate users. The primary impact is the ability of an attacker to deface pages, steal session cookies, or perform other client‑side malicious actions, compromising confidentiality and integrity of user data.

Campcodes Division Regional Athletic Meet Game Result Matrix System version 2.1 is affected. The issue is located in the save_up_athlete.php component, with no other versions or vendors identified. The specific code path that processes the a_name field is vulnerable.

The CVSS score of 5.1 indicates moderate severity, while the EPSS score of <1% suggests a low probability of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. Remote execution is possible; the publicly available exploit demonstrates that an attacker can deliver the malicious payload without additional prerequisites beyond access to the vulnerable endpoint.