This vulnerability affects SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 in the registration component. Specifically, the parameters student_id, full_name, section, and username in /index.php?action=register are vulnerable to cross-site scripting attacks. An attacker can craft malicious input to execute scripts in the context of a victim's browser. The attack vector is network-based with no privileges required but requires user interaction. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity). No official remediation or patch has been documented as of the publication date.

Successful exploitation of this XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of users interacting with the registration page. This may lead to session hijacking, defacement, or other client-side attacks. However, the vulnerability requires user interaction and does not grant direct access to the server or escalate privileges. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with the registration page and consider implementing web application firewall (WAF) rules to detect and block suspicious input targeting the affected parameters. Avoid using the vulnerable version in production environments if possible.