A vulnerability was determined in Code‑Projects Exam Form Submission 1.0, affecting unknown code in /admin/update_s6.php. Manipulating the "sname" argument can lead to cross‑site scripting. Because the application exposes a web interface, a remote attacker can trigger the vulnerability by sending a crafted request. The impact is that the victim's browser will execute the injected script, potentially leading to session hijacking, defacement, or phishing. The weakness is classified as CWE‑79, and the description notes CWE‑94, but there is no indication of server‑side code execution.

The affected product is Code‑Projects Exam Form Submission, version 1.0. The vulnerability specifically targets any deployment that includes the admin/update_s6.php file. The CPE entry confirms the association with code‑projects:exam_form_submission. Because the source is public, any installation that has not applied a fix remains vulnerable.

The CVSS base score of 4.8 indicates a medium severity. The description states that the attack can be launched remotely; no authentication or privileged access is explicitly required. EPSS data, at 0.00032 (less than 1%), indicates a very low probability of exploitation. The vulnerability is not present in the CISA KEV catalog, yet publicly disclosed exploits exist, so the risk remains real. If an attacker submits a malicious value for "sname" to the vulnerable endpoint, the injected script will run in the context of any user who loads the page, exposing them to potential compromise.