A flaw in the Registration component of SourceCodester’s CET Automated Grading System with AI Predictive Analytics allows an attacker to inject malicious JavaScript through the student_id, full_name, section, or username parameters of the /index.php?action=register endpoint. This injection can lead to stored or reflected XSS attacks that compromise the confidentiality and integrity of user data in the victim’s browser. The underlying weakness corresponds to CWE‑79 and, based on the description, also relates to code injection (CWE‑94).

The vulnerability exists in SourceCodester’s CET Automated Grading System with AI Predictive Analytics version 1.0. No other versions are documented in the vendor statement.

The CVSS score of 5.3 indicates a moderate severity, and the lack of an EPSS score does not provide insight into exploitation likelihood, though the exploit is publicly available. The attack can be launched remotely through the public Registration page without authentication, and the system is listed as not included in the CISA KEV catalog.