This vulnerability in code-projects Online Examination System 1.0 allows remote attackers to perform cross-site scripting via the eid parameter in the /account.php?q=quiz endpoint. The flaw arises from improper input validation or sanitization of this parameter, enabling injection of malicious scripts. Exploitation requires user interaction but no privileges or authentication. The vulnerability has been publicly disclosed, but no vendor-provided fix or mitigation details are available at this time.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser when visiting the vulnerable endpoint. This may lead to session hijacking, defacement, or other client-side attacks. However, the impact is limited by the need for user interaction and the absence of privilege requirements.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable endpoint or applying web application firewall (WAF) rules to detect and block malicious input targeting the eid parameter. Avoid relying solely on client-side mitigations.