The code-projects Project Management System version 1.0 contains a cross-site scripting vulnerability in the /mail.php file within the Mail Compose Page component. This vulnerability enables remote attackers to inject malicious scripts due to insufficient input sanitization or output encoding. The vulnerability has been publicly disclosed, but there is no vendor-provided fix or official remediation at this time. The CVSS 4.0 base score is 5.1, indicating a medium severity level with network attack vector, low attack complexity, and requiring low privileges with user interaction.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other malicious actions within the user's browser session. The impact is limited by the need for user interaction and low privileges required by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding workarounds on the /mail.php component if feasible. Monitor official vendor channels for updates and patches.