This vulnerability involves a cross-site scripting (XSS) flaw in the Ship Ferry Ticket Reservation System 1.0 by SourceCodester. Specifically, the Username parameter in the administrative user management page (/admin/?page=user/manage_user) is vulnerable to script injection. The vulnerability can be exploited remotely without requiring user interaction, but requires high privileges (PR:H) and user interaction (UI:P) according to the CVSS vector. No vendor advisory or patch information is provided, and the vulnerability state is published with no remediation level assigned.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of an administrative user session, potentially leading to session hijacking, defacement, or other malicious actions within the affected system. However, exploitation requires high privileges and user interaction, which limits the ease of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting access to the affected administrative interface and validate or sanitize input parameters where possible to mitigate the risk of XSS attacks.