This vulnerability in code-projects Assessment Management 1.0 allows remote attackers to perform cross-site scripting via the ID parameter in /admin/remove-user.php. The vulnerability arises from insufficient input validation or sanitization of this parameter, enabling injection of malicious scripts. Exploitation requires user interaction but no privileges or authentication. The vulnerability has been publicly disclosed, but no official fix or patch is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to session hijacking, defacement, or other client-side attacks. However, the attack requires user interaction and does not grant direct system or data access. The medium CVSS score reflects these factors.

No official patch or remediation has been announced by the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted links or inputs related to the affected parameter. Implementing web application firewall (WAF) rules to detect and block XSS payloads targeting the ID parameter may provide temporary mitigation.