The flaw allows an attacker to supply a crafted value for the full_name argument that is echoed during the prepend operation without proper sanitization. When a victim opens the page, the injected script executes in the victim’s browser, enabling session hijacking, credential theft, or delivery of further malware. The vulnerability is classified as a reflected XSS (CWE-79) and a possible code injection weakness (CWE-94).

SourceCodester Smart Attendance System with QR Code Scanner, version 1.0. The affected component is the Self‑Registration module located in student_signup.php.

The CVSS base score is 5.3, indicating a moderate severity. The EPSS score is unavailable, but the exploit is publicly known and can be launched remotely by sending a crafted HTTP request with the full_name parameter. The vulnerability is not listed in CISA KEV. The attack vector is remote, requiring only that the victim load the vulnerable page after the attacker has supplied the malicious input.