Ask Expert Script 3.0.5 contains cross‑site scripting and SQL injection flaws that can be triggered by unauthenticated users through the cateid parameter in categorysearch.php or the view parameter in list‑details.php. An attacker can inject malicious script tags or SQL code, allowing execution of arbitrary code in the victim’s browser or extraction of database information. The vulnerability therefore enables data theft and cross‑site scripting.

Phpscriptsmall’s Ask Expert Script version 3.0.5 is vulnerable. The flaw exists in the web application shipped by the vendor and can affect any instance that has not been patched or updated.

The CVSS score of 8.8 classifies this as high severity. The EPSS score is < 1%, indicating a very low but non-zero likelihood of exploitation, and it is not listed in the CISA KEV catalog. The attack requires only an unauthenticated HTTP request to a publicly reachable URL. Because the exploit merely involves passing crafted query string values, it is straightforward for an attacker with internet connectivity to attempt exploitation. No authentication or privileged access is required, making the risk significant.