GDTaller contains a reflected Cross‑Site Scripting flaw that can be triggered through the 'site' parameter of the app_recuperarclave.php script. An attacker can send a specially crafted URL containing malicious JavaScript. When a user follows that link the script executes in the context of the victim’s browser, permitting actions such as cookie theft, session hijacking, or the injection of additional malicious content. The weakness aligns with CWE‑79 and is limited to the victim’s web session, not providing direct control over the server.

The vulnerability affects the GDTaller application distributed by GDTaller. Specific affected version information is not supplied in the CVE record, so any deployment using a version prior to the vendor’s patch is likely vulnerable.

The CVSS score of 5.1 indicates moderate severity. The EPSS score is below 1 %, suggesting that exploitation attempts are currently unlikely to be widespread. The vulnerability is not listed in the CISA KEV catalog, meaning no known active exploitation has been reported. Exploitation requires the target user to click a malicious link; thus, typical risk depends on user interaction and the visibility of the crafted URLs.