This vulnerability affects SourceCodester Simple Traffic Offense System 1.0, specifically in the save-settings.php file's Settings Update Endpoint. Manipulating the site_name or site_desc arguments leads to a cross-site scripting condition, allowing remote attackers to inject and execute arbitrary scripts in the context of the affected application. The vulnerability is publicly disclosed, but no vendor-provided fix or mitigation details are available at this time.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the vulnerable application, potentially leading to session hijacking, defacement, or other malicious actions that rely on script execution in the victim's browser. The CVSS score of 5.3 indicates a medium impact with no privileges or user interaction required, but user interaction is present (UI:P).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or output encoding on the site_name and site_desc parameters as a temporary mitigation. Monitor vendor channels for updates.