The vulnerability appears in the user management portion of SourceCodester Leave Application System 1.0, allowing attackers to inject persistent malicious JavaScript that is executed whenever a user views the compromised data. This flaw, classified as input validation weakness and dynamic code execution, can enable session hijacking, credential theft, defacement or other client‑side abuses. The attack vector relies on malicious input being saved and later rendered without proper sanitization.

SourceCodester Leave Application System version 1.0 is affected. Users running this release or earlier versions are potentially at risk. No newer versions that contain a fix are listed.

The base vulnerability score is 4.8, indicating moderate risk. No publicly available probability measure has been published. The flaw is not recorded in the CISA Known Exploited Vulnerabilities catalog. An attacker can exploit the flaw remotely by inserting crafted input into an administrative or user field, which is then stored and displayed to other users. Execution requires that a victim views the affected content, after which the injected script runs in that user’s browser, potentially leading to the compromise of session information or other client‑side data.