The vulnerability resides in the SourceCodester Online Quiz System up to version 1.0, specifically in the add‑question.php endpoint. Manipulating the quiz_question parameter allows an attacker to inject arbitrary script code, which the application renders without proper sanitization. This results in classic reflected cross‑site scripting, which can be triggered remotely through crafted URLs or form submissions. The impact is the potential theft of user credentials or session hijacking of any authenticated user who views the injected page.

Affected systems are instances of SourceCodester’s Online Quiz System running version 1.0 or earlier. No specific sub‑components or plugins are enumerated; the flaw is tied to the add‑question.php functionality within the core application. Users who host or deploy this version are therefore vulnerable.

With a CVSS score of 5.1, the flaw is considered moderate in severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The exploit requires only remote access to the vulnerable endpoint and does not need elevated privileges, so an external attacker can easily execute the attack by sending a crafted request. If the application allows anonymous or low‑privilege users to access add‑question.php, the risk is amplified.