This vulnerability affects the code-projects Coaching Management System version 1.0. It arises from insufficient input validation or sanitization of the Complaint parameter in the complaint.php script within the student module. An attacker can remotely inject malicious scripts via this parameter, leading to cross-site scripting. The vulnerability is publicly known, but there is no vendor-provided patch or official remediation at this time. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on confidentiality and integrity.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to the confidentiality and integrity of the user interface and data accessible via the vulnerable parameter. There is no indication of direct impact on system availability or server-side data compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or output encoding on the Complaint parameter as a temporary mitigation. Additionally, restricting user input and employing web application firewalls (WAF) may help reduce risk. Monitor vendor channels for updates and patches.