A function within diary.php of SourceCodester Diary App 1.0 accepts malicious input that can be used to perform a cross‑site request forgery. The flaw allows an attacker to send a crafted request on behalf of a legitimate user, potentially creating, editing, or deleting diary entries without the user’s consent. The official description identifies the weakness as a CSRF (CWE‑352) and a missing authentication check (CWE‑862). No mention is made of remote code execution; the impact is limited to unauthorized manipulation of diary data.

The application affected is SourceCodester Diary App version 1.0. The weakness resides in the diary.php script. No other versions or products are listed in the CVE data, so only this instance is impacted.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available and the vulnerability is not in CISA’s KEV list. The exploit can be triggered remotely by submitting a forged HTTP request; it typically requires the victim to be authenticated, but the description does not explicitly state this. Given the lack of a publicly available patch, the risk remains present until a fix is deployed or mitigation measures are applied.