A vulnerability exists in the Alert Handler’s /home.php of the code‑projects Social Networking Site version 1.0. An attacker can craft a malicious payload in the content argument that is not properly escaped, resulting in cross‑site scripting. The injected JavaScript executes in the victim’s browser when they view the affected page, allowing arbitrary script execution in the client context. The weakness aligns with CWE‑79 and the code‑injection profile points to CWE‑94.

The flaw is limited to instances of code‑projects Social Networking Site 1.0 that expose the /home.php endpoint of the Alert Handler component. No other products or versions are currently listed as affected, so only this single product and component are confirmed vulnerable.

The CVSS v3.1 base score of 5.1 suggests moderate severity. EPSS data is not available and the vulnerability is not included in CISA’s KEV catalog. The description notes remote exploitation and a publicly available exploit, indicating that the attack vector is web‑based: an adversary supplies a crafted content value, triggers the vulnerable page, and the victim’s browser runs the injected code. Because the flaw is client‑side, the attacker does not need to compromise the server, but can still carry out credential theft, session hijacking, or defacement if the victim’s session is active.