The vulnerability resides in the /admin/update_s5.php script of Exam Form Submission 1.0, where an attacker can supply a malicious payload in the sname parameter that is rendered without proper escaping. Because the value is output to a browser, an injected script runs in the context of any user who views the affected page, allowing cookie theft, session hijacking, defacement or other client‑side attacks.

All installations of Exam Form Submission 1.0 that expose the /admin/update_s5.php endpoint are affected. The flaw is specific to the code‑projects product and its admin update machinery.

The CVSS score of 4.8 indicates moderate severity. The flaw is remote‑usable from outside the application, and a public proof‑of‑concept has been released. The EPSS score is not available, but the existence of a public exploit suggests a non‑negligible chance that attackers will try to use it. The vulnerability is not yet in the CISA KEV catalog, yet the attacker could still target exposed instances without much difficulty.