The vulnerability is a stored XSS flaw introduced through the costumer_name parameter in /my_account/add_costumer.php. When malicious script is entered, it is later rendered to users in the same browser, allowing an attacker to steal session cookies, deface pages, or perform phishing attacks. This weakness is identified as CWE‑79 and involves potential code injection (CWE‑94).

The affected product is code‑projects Accounting System 1.0, a PHP‑based web. No additional versions are listed, so this version is known to be vulnerable.

The CVSS score of 5.1 places the flaw in the medium range, and the EPSS score is unavailable, so the exact probability of exploitation is unclear. However, the flaw can be triggered from an unauthenticated HTTP request to the add_costumer.php endpoint by simply submitting a malicious value for costumer_name, and can be abused remotely. The vulnerability is not currently tracked by CISA KEV, but the public disclosure and remote exploitability suggest a reasonable risk of exploitation if left unpatched.