The vulnerability occurs in the file /lawyers.php of version 1.0 of the projectworlds Lawyer Management System. By manipulating the first_Name query parameter, an attacker can inject arbitrary HTML or JavaScript code that is reflected back to the user’s browser. This leads to cross‑site scripting, which can be used to steal cookies, hijack sessions, or deface the site. The issue is tracked as a CWE‑79 vulnerability; an additional CWE‑94 flag is present but the description points mainly to unsanitized input leading to reflected XSS.

Affected systems are installations of projectworlds Lawyer Management System, specifically version 1.0. No other versions are explicitly listed, so users of earlier or later releases are not known to be impacted. The vulnerability is triggered through the first_Name argument in the lawyers.php script, which is publicly reachable via a web request.

The CVSS score is 5.1, indicating a medium severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, as indicated by the publicly available exploit; an attacker only needs to craft a request to the vulnerable endpoint and can trigger the injection without authentication. Because the input is not sanitized, exploitation can occur easily in any environment that hosts the vulnerable application.