The vulnerability is a reflected XSS flaw located in the cmis-online/type endpoint of Alkacon OpenCms versions older than 10.5.1. The description indicates that the endpoint is vulnerable, which infers that user input is not properly sanitized before being returned to the browser. Exploitation could cause a victim's browser to execute arbitrary JavaScript, potentially leading to session hijacking, defacement, or redirection to malicious sites. The weakness is identified as CWE‑79, and the CVSS score of 6.1 categorizes it as a medium‑severity issue.

Alkacon OpenCms installations running any version before 10.5.1 are affected, specifically through the cmis‑online/type module used for CMIS operations.

EPSS is reported as < 1%, indicating a low probability of exploitation, and the vulnerability is not listed in CISA KEV, meaning no publicly known exploits exist at this time. The CVSS score of 6.1 reflects a medium severity. The flaw can be triggered remotely via an unauthenticated HTTP request to the cmis‑online/type endpoint, as it is a publicly accessible URL; this attack vector is inferred because the description does not detail it explicitly.