The flaw exists in the /admin/update_s7.php script of the Exam Form Submission application. An attacker can submit a crafted sname value that is not correctly sanitized before being reflected to the browser, resulting in the execution of arbitrary JavaScript or HTML code within the victim’s session. The description does not indicate additional damage beyond the manipulation of the sname parameter.

The affected system is code‑projects Exam Form Submission version 1.0. The vulnerability resides in an unspecified function of the update_s7.php file located in the administrative interface of the application. No other product versions or vendor variants have been reported.

The CVSS score of 4.8 places this issue in the moderate category. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the flaw is not listed in the CISA KEV catalog. Attack can be carried out remotely and publicly available exploit code means a threat actor can target any publicly accessible instance of the application without needing elevated privileges.