A cross-site scripting (XSS) vulnerability exists in SourceCodester Online Leave Management System 1.0 within the Employee Avatar Upload Extension. The flaw arises from improper handling of the employee avatar filename parameter in the app/classes/Master.php file, allowing remote attackers to inject malicious scripts. Exploit code is publicly available. The vulnerability has a low CVSS score of 2.4, indicating limited impact.