A flaw in SourceCodester Safety Anger Pad 1.0 allows an attacker to supply a malicious payload through the angerDisplay parameter, which is reflected directly in the page output. When a victim visits the affected page, the injected JavaScript runs in their browser and can perform actions that the original page intended only for legitimate users.

Only SourceCodester Safety Anger Pad 1.0 is indicated as vulnerable; no other versions or related products were reported affected.

The CVSS score of 5.3 indicates a moderate severity level. Based on the description, it is inferred that the attack may be performed remotely, though the necessity of authentication is not explicitly stated; the exploit is publicly available, meaning attackers can target any exposed instance. The EPSS score of less than 1% suggests a low probability of current exploitation, and the vulnerability is not listed in the CISA KEV catalog; however, as a reflected XSS flaw it remains a common risk surface.