CVE-2025-60302 identifies a Cross Site Scripting (XSS) vulnerability in code-projects Client Details System 1.0. Specifically, the system does not properly sanitize input in the username field when adding customer information, allowing injection of malicious JavaScript code. This vulnerability can be exploited remotely without privileges, requiring user interaction, and impacts confidentiality and integrity with no impact on availability, as reflected by the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

An attacker can inject and execute arbitrary JavaScript code in the context of the vulnerable application by submitting malicious input in the username field. This can lead to partial confidentiality and integrity compromise of the affected system's data. There is no known impact on system availability. No known exploits are reported in the wild at this time.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should exercise caution when entering or accepting input from untrusted sources in the username field. Implementing input validation and output encoding on the client and server side may help mitigate exploitation.