The vulnerability in code-projects Assessment Management 1.0 is a cross-site scripting (XSS) flaw located in an unknown function within the admin/add-user.php file. Specifically, manipulation of the 'level' parameter enables injection of malicious scripts. The attack vector is remote network access, with low attack complexity, requiring high privileges and user interaction. The vulnerability does not affect confidentiality, integrity, or availability directly but can be used to execute scripts in the context of a logged-in administrator. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation allows an attacker with high privileges to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not directly compromise system confidentiality, integrity, or availability but can facilitate further attacks through script execution in the administrator's browser.

No official patch or remediation is currently documented. Users of code-projects Assessment Management 1.0 should monitor vendor advisories for updates. Until a fix is available, restrict access to the admin interface to trusted users only and apply web application firewall (WAF) rules to detect and block malicious input targeting the 'level' parameter. Validate and sanitize all user inputs on the server side where possible.