This vulnerability in Akpali9 Attendance-Management-System involves improper handling of the export_date parameter in absent.php, leading to cross-site scripting (CWE-79). The issue allows remote attackers to execute scripts in the context of the affected application. The product's rolling release model means no discrete version numbers are provided for affected or fixed releases. The vendor has not issued any advisory or patch, and the remediation level is unknown. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low attack complexity, no privileges required, but user interaction needed.

Successful exploitation can result in execution of arbitrary scripts in the context of the vulnerable web application, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction and low privileges but can be triggered remotely. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider applying web application firewall (WAF) rules to filter malicious input targeting the export_date parameter and avoid using the affected functionality if possible until a fix is released.