This vulnerability affects itsourcecode Fees Management System 1.0. An attacker can remotely exploit a cross-site scripting flaw by manipulating the 'page' parameter in the index.php file. This allows injection of malicious scripts that could be executed in the context of the victim's browser. The CVSS 4.0 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. No vendor patch or official fix information is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users accessing the vulnerable application, potentially leading to session hijacking, defacement, or other client-side attacks. However, the vulnerability requires user interaction and does not grant direct system access or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on the 'page' parameter as a temporary mitigation. Additionally, educating users to avoid clicking suspicious links may reduce risk.