This vulnerability in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 involves a cross-site scripting flaw due to improper sanitization of the 'action' parameter in the /index.php file. An attacker can remotely supply crafted input to this parameter to execute arbitrary scripts in the context of the victim's browser. The vulnerability is classified with a CVSS 4.0 base score of 5.3 (medium severity), indicating it requires no privileges and no user interaction is needed, but user interaction is present (UI:P) and the impact is limited to integrity and availability with no confidentiality impact. There is no vendor-provided patch or official remediation at this time.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to the integrity and availability of the affected system as per the CVSS vector, with no direct confidentiality impact reported. The vulnerability can be exploited remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing web application firewall (WAF) rules to detect and block malicious input targeting the 'action' parameter. Additionally, review and apply input validation and output encoding best practices in the application code if possible.