This vulnerability is a Cross Site Scripting (CWE-79) issue in the sunnygkp10 Online Exam System master version. An attacker can remotely exploit the 'w' parameter to execute script code in the context of a victim's browser, potentially leading to disclosure of sensitive information. The CVSS vector indicates the attack requires no privileges and user interaction, affects confidentiality and integrity, but not availability. No official remediation or patch information is available at this time.

Successful exploitation can lead to partial loss of confidentiality and integrity by allowing an attacker to obtain sensitive information through script execution in a victim's browser. There is no impact on system availability. The vulnerability can be exploited remotely without authentication but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted input in the 'w' parameter and consider implementing web application firewall rules or input validation as temporary mitigations.