A flaw in the lawyers.php page of the 1.0 release of the Projectworlds Lawyer Management System allows an attacker to inject the content of the first_Name parameter into the page without proper escaping. The injected data is reflected back in the browser, enabling execution of arbitrary JavaScript. The description implies that the attacker could hijack sessions, steal credentials, or perform other client‑side attacks, but the severity of those consequences is not detailed in the advisory. The type of XSS is not explicitly defined; it is inferred to be reflected based on the description of manipulating an argument that is displayed. The weakness aligns with CWE‑79 and includes a code manipulation aspect (CWE‑94).

This vulnerability is reported only for Projectworlds Lawyer Management System version 1.0. No other releases or vendors are listed in the CNA data, so the scope appears limited to that release.

The CVSS score of 5.1 places the issue in the moderate severity range, while the EPSS estimate of below 1 percent suggests that broad exploitation is unlikely at present. The advisory states the exploit is publicly available and can be triggered remotely by sending a crafted request to lawyers.php. The vulnerability is not included in the CISA KEV catalog, indicating that it has not yet been widely targeted, but the remote nature and potential for client‑side compromise mean it should be addressed promptly.