The Online Reviewer System contains a critical cross‑site scripting flaw that can be triggered by manipulating the Description argument in the btn_functions.php file. The vulnerability is a CWE‑79 type flaw that allows an attacker to inject malicious JavaScript into pages served to users, potentially enabling session hijacking, credential theft, or malicious defacement. While the vendor marks affected versions up to 1.0, no further mitigation is present in the code base, leaving the application vulnerable to script injection whenever the Description field is displayed without proper encoding.

The system is the code‑projects Online Reviewer System, versions up to 1.0. No additional patch or version information is supplied, and the vulnerability description indicates that the issue exists in the btn_functions.php endpoint that handles the Description parameter. Users running any version of the platform prior to 1.0 are potentially exposed.

The CVSS score of 4.8 indicates moderate severity. The EPSS value is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not be widely exploited yet. However, the description confirms that the flaw can be exploited remotely, meaning an attacker can deliver malicious payloads simply by triggering the vulnerable endpoint from a web browser. Because the vulnerability hinges on unsanitized input, no special conditions are required beyond user interaction with the affected page. The risk therefore stems from the fact that an attacker can covertly inject code that runs in the victim’s browser whenever that page is viewed, presenting a tangible threat to confidentiality and integrity of the client session.