The flaw allows an attacker to inject arbitrary JavaScript code through the msg parameter of the /admin/send_message.php endpoint. When the chat interface renders the message without proper sanitization, the injected script executes in the browsers of any user who views the affected chat message. This can lead to the compromise of the user’s session, defacement of the chat interface, or execution of additional malicious actions, all within the context of the victim’s browser. Based on the description, it is inferred that the typical impact of this XSS flaw is the potential for unauthorized client‑side code execution, but explicit claims of session hijacking or credential theft are not documented in the CVE data.

Vendors: code‑projects; Product: Chat System version 1.0. The vulnerability resides in the /admin/send_message.php script that processes message submissions. All users who view messages handled by this component, including registered participants and administrators, are potentially exposed.

The CVSS score of 4.8 denotes moderate severity, while the EPSS score of less than 1% indicates a low current exploitation probability. The flaw is not listed in the CISA KEV catalog. Attackers may target the vulnerability remotely by issuing HTTP requests to the vulnerable admin endpoint and supplying a crafted msg parameter, implying that the attack vector is a remote web request over the public network.