The vulnerability affects code-projects Task Management System 1.0 and involves improper processing of the comment, task_id, mineId, recId, myName, and myImage parameters in the /user/CommentSave.php endpoint. This flaw enables remote attackers to perform cross-site scripting attacks by injecting malicious scripts. The vulnerability has been publicly disclosed with exploit code available, but there is no official fix or patch published by the vendor as of now.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other malicious actions that rely on script execution in the victim's browser. The attack requires user interaction and does not escalate privileges or compromise the underlying server directly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on the affected parameters as a temporary mitigation. Monitoring for suspicious activity related to comment submissions may also help detect exploitation attempts.