This vulnerability involves a cross-site scripting flaw in code-projects Record Management System 1.0, specifically in an unknown function of main/reg.php. An attacker can manipulate the 'desc' parameter to inject malicious scripts. The attack vector is network-based with no privileges required and no user interaction needed to initiate the attack, but user interaction is required for the attack to succeed. The vulnerability does not involve confidentiality, integrity, or availability impacts but can lead to limited integrity impact. Exploit code is publicly available, but no known exploitation in the wild has been reported.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to limited integrity impact. There is no direct impact on confidentiality, availability, or system control. The attack requires user interaction to trigger the malicious script.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying input validation or output encoding on the 'desc' parameter to mitigate XSS risks.