A reflected Cross‑Site Scripting vulnerability exists in Anon Proxy Server v0.104. An attacker can embed malicious JavaScript in a URL that targets the 'port' or 'proxyPort' parameters in the /anon.php endpoint. When a user opens the crafted link, the script runs in their browser, allowing the attacker to steal session cookies or trigger actions on behalf of the user. This type of client‑side injection can compromise user confidentiality and establish persistence in a session.

The affected product is Anon Proxy Server provided by the vendor Anon Proxy Server. Only version 0.104 is listed as vulnerable. Users running this specific release, which accepts 'port' and 'proxyPort' parameters on the /anon.php endpoint, are at risk.

The CVSS base score is 5.1, indicating a moderate risk, and the EPSS score is below 1 %, suggesting low probability of exploitation in the near term. The vulnerability is not currently in the CISA KEV catalog. Exploitation requires an end‑user to visit a malicious URL, so the attack vector is indirect but feasible through phishing or compromised sites. If executed, it could expose session credentials and allow malicious actions without elevated privileges.