This vulnerability affects code-projects Employee Management System 1.0 and involves improper handling of input in the 370project/mark.php file, which leads to cross-site scripting. The vulnerability can be exploited remotely without authentication, requiring user interaction (UI:P). The CVSS 4.0 base score is 5.3, indicating a medium severity impact primarily due to the potential for limited integrity impact and no privileges required for exploitation. No official fix or patch has been published, and the vendor has not provided remediation details.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the vulnerable application, potentially leading to session hijacking, defacement, or other malicious actions affecting users interacting with the system. The impact is limited to the scope of the XSS vulnerability with no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding workarounds if feasible. Monitor for updates from the vendor regarding patches or official mitigations. No vendor advisory or patch links are currently provided.