A flaw has been found in an undefined function of the /admin/update_s3.php script of Exam Form Submission. By manipulating the sname argument, the application echoes the supplied value back to the browser without proper encoding, resulting in a reflected XSS issue. This flaw allows an attacker to insert malicious script code that will run in the victim’s browser when the crafted URL is visited. While the CVE description does not explicitly list potential downstream effects, it is inferred from typical XSS behavior that such scripts could steal session cookies or display unwanted content.

Only code‑projects Exam Form Submission version 1.0 is known to contain this vulnerability; no other releases have been identified as impacted.

The CVSS base score of 4.8 indicates moderate risk, mainly affecting confidentiality and integrity. EPSS information is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, as an attacker only needs to send an HTTP request containing a malicious value for sname. The exploit has been publicly disclosed, so attackers could feasibly craft a malicious request, but no active exploits are reported.