The flaw arises from the Online Support Application’s failure to neutralize user input before incorporating it into generated web pages, allowing attackers to inject arbitrary JavaScript code. In a reflected XSS attack, such code runs in the victim’s browser context, potentially exposing the victim to malicious actions performed by the attacker.

Tegsoft Management and Information Services Trade Limited Company’s Online Support Application is the affected product. All versions from V3 up to the release dated 31‑12‑2025 contain the vulnerability; newer releases are not reported to be vulnerable.

The CVSS score of 9.8 indicates a critical severity. The EPSS value is not available and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is a web‑browser that accesses the application with a crafted URL, requiring no special privileges beyond normal access to the interface; this inference is based on the nature of a reflected XSS flaw.