This vulnerability affects SourceCodester Safety Anger Pad 1.0 and involves a cross-site scripting flaw triggered by manipulation of the angerDisplay argument in an unspecified function. The vulnerability can be exploited remotely without privileges and requires user interaction. The CVSS 4.0 base score is 5.3, indicating medium severity. No official fix or patch is currently documented, and the vendor has not released remediation information. The vulnerability was published on April 28, 2026, with the exploit details publicly available.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of a victim's browser session when they interact with the affected functionality. This can lead to theft of sensitive information, session hijacking, or other client-side impacts. However, the vulnerability requires user interaction and does not grant direct system access or escalate privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on the angerDisplay argument if possible, or restrict access to the affected functionality. Monitor vendor channels for updates and patches.