SourceCodester Online Quiz System version 1.0 contains a cross-site scripting vulnerability in the endpoint/add-question.php file. The vulnerability arises from improper sanitization of the quiz_question parameter, allowing remote attackers to inject and execute arbitrary scripts in the context of the affected application. This can be exploited remotely without authentication, with low complexity and partial user interaction required. The CVSS 4.0 base score is 5.1, indicating medium severity. No patch or official remediation guidance has been provided as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript in the context of the affected application, potentially leading to session hijacking, defacement, or redirection to malicious sites. However, the impact is limited by the requirement for some user interaction and the absence of elevated privileges or confidential data exposure. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying input validation or sanitization on the quiz_question parameter at the application level. Additionally, deploying web application firewalls (WAFs) with XSS detection rules may help mitigate exploitation attempts. Monitor official SourceCodester channels for updates and patches.