This vulnerability involves a cross-site scripting issue in the BloodBank Managing System 1.0 by code-projects. Specifically, the statename argument in the /admin_state.php file is not properly sanitized, allowing an attacker to inject and execute arbitrary scripts in the context of a victim's browser. The attack can be initiated remotely and requires the victim to interact with the malicious input. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on integrity and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. However, the impact on system integrity and availability is low. The vulnerability requires user interaction and can be exploited remotely.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider applying input validation or sanitization on the statename parameter as a temporary mitigation and avoid exposing the vulnerable interface to untrusted users.