The vulnerability described is a reflected cross‑site scripting flaw found in the /admin/update_s1.php file of code‑projects Exam Form Submission. By manipulating the sname argument, an attacker can inject and execute arbitrary JavaScript in the browsers of users who view the affected page. The flaw is limited to the input handling of sname and does not allow arbitrary code execution on the server or arbitrary data access. The impact is confined to the browsers that request the vulnerable endpoint, potentially leaking information or manipulating the page presented to the victim.

This flaw affects only the 1.0 release of code‑projects Exam Form Submission. The vulnerability is located in an unknown function within the admin interface at /admin/update_s1.php. No other product versions are listed as affected, and there is no information about available patches or updates from the vendor.

The CVSS score of 5.3 indicates moderate severity, and the exploit is publicly available, meaning that malicious actors can trigger the vulnerability over the network by sending a crafted HTTP request containing a malicious sname value. Although an EPSS score is not provided and the vulnerability is not listed in CISA’s KEV catalog, the combination of remote attack capability and public availability suggests that organizations running this application should treat the issue with high priority until a vendor fix or appropriate mitigation is applied.