The CVE is described as a cross‑site scripting flaw in profile.php involving the email query parameter. An attacker can inject JavaScript that will execute in the victim’s browser, potentially exposing session cookies, modifying the UI, or redirecting to phishing sites. The issue is classified as CWE‑79. The CVE record also lists CWE‑94, but the description does not explain a code execution path.

Projectwolds Online Attendance System version 1.0 is affected. The flaw resides in the profile.php component of this release; no other versions are currently documented as vulnerable.

With a CVSS base score of 5.1, the risk is moderate. The exploit is remotely accessible, has been published to the public, and no known KEV listing exists. Because the EPSS score is not available, the exact probability of exploitation is uncertain, but the publicly available exploit and the remote nature of the attack indicate that the vulnerability could be abused if a user visits the vulnerable page with a crafted email parameter.