Administrator-browser script execution via stored real name

Stored cross-site scripting in HZNUOJ 1.0 allows remote attackers to execute script in an administrator's browser through a crafted real name. The registration path accepts angle brackets in the real-name field, stores the value, and cal_scores.php renders that database value into an output form without HTML escaping. Exploitation requires account registration and an administrator to select the attacker's class and submit the score form, exposing the administrator's browser session to attacker-controlled script.