The vulnerability is a reflected XSS that occurs when a malicious value is supplied through the PageTitle/Notes parameter in the Notes.aspx endpoint of ProPhoenix Law RMS v2022.2403.3.101. The flaw allows an attacker to inject arbitrary JavaScript that will be executed in the context of a victim’s browser when the crafted URL is accessed, potentially enabling the modification of page content or the execution of client‑side code at the victim’s discretion. Based on the description, the attack vector is inferred to be a crafted URL that injects malicious content into the PageTitle/Notes parameter. The exploitation details are inferred from the description.

ProPhoenix Law RMS version 2022.2403.3.101 is affected; no other products or vendors are listed in the CVE data.

The flaw is client‑side and can be triggered by a crafted URL, so an attacker only needs to entice a user to open a malicious link. The CVSS base score of 6.1 indicates a medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because it permits arbitrary JavaScript execution in the victim’s browser, the potential for client‑side compromise remains, but exploitation would require user interaction via a web link. Based on the description, the likely attack vector is a crafted URL with malicious content in the PageTitle/Notes parameter. The exploitation details are inferred.