A flaw in the /admin_state.php script of the code‑projects BloodBank Managing System allows an attacker to supply a crafted statename argument that is echoed back to the browser without proper encoding. This enables the execution of arbitrary scripts within the victim’s browser context, compromising confidentiality, integrity, and availability for users who view the affected page. The weakness aligns with CWE‑79 (Cross‑Site Scripting) and is also reflected in CWE‑94 (Code Injection) as the server processes the input before rendering.

The vulnerability impacts the code‑projects BloodBank Managing System version 1.0. It resides specifically in the admin_state.php file where the statename parameter is handled. No other vendors or product versions are reported as affected based on the supplied information.

The CVSS base score of 5.3 indicates moderate severity. The description states that a remote attacker can initiate the attack by sending a crafted request, implying a public attack vector. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. Even so, the flaw is publicly disclosed and could affect any system exposed to the statename endpoint, warranting timely remediation.