SourceCodester Smart Attendance System with QR Code Scanner 1.0 contains a cross-site scripting (XSS) vulnerability in the reset_password.php file. This vulnerability is triggered by manipulation of the Username argument and can be exploited remotely. The vulnerability has a medium severity rating and a CVSS score of 4.3. Public exploit code has been disclosed.