This vulnerability in code-projects Chat System 1.0 involves improper sanitization of the 'msg' argument in the /admin/send_message.php component of the chat interface. An attacker with high privileges can remotely inject malicious scripts via this parameter, leading to cross-site scripting. The CVSS 4.0 base score is 4.8, indicating medium severity with network attack vector, low attack complexity, no privileges required for attack initiation but user interaction is needed, and limited impact on integrity. No official fix or patch has been published yet.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction and elevated privileges, which limits the scope of impact. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected component to trusted users only and apply input validation or sanitization controls if possible to mitigate injection of malicious scripts.