ProPhoenix Law RMS v2022.2403.3.101 contains a reflected cross‑site scripting vulnerability. The flaw arises when the PageTitle, Alert, or MsgType query parameters are accepted by the errorHandler.aspx endpoint without proper sanitization, allowing an attacker to embed malicious scripts that are reflected back in the HTTP response. If exploited, an attacker could run arbitrary JavaScript in the victim’s browser context, potentially leading to session hijacking, credential theft, or defacement. This weakness falls under the CWE classification for cross‑site scripting.

ProPhoenix Law RMS version 2022.2403.3.101. The vulnerability impacts the errorHandler.aspx component of this product. No other vendor or product versions are explicitly listed.

Because the issue is a reflected XSS in a publicly accessible error handling page, the likely attack vector is through a crafted URL or form input that is sent over HTTP or HTTPS to the target system. The CVSS score of 6.1 indicates a moderate severity, and the EPSS score of <1% suggests a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, indicating that no widespread exploitation data has been reported to date. Without an official patch in the public domain, the risk depends on exposure level of the affected endpoint and the attacker’s ability to direct victims to the malicious URL. Mitigation requires proper output encoding and client‑side policies to contain potential damage while a vendor fix is applied.