The vulnerability is a reflected Cross‑Site Scripting flaw located in the host parameter of the \/diagconnect.php endpoint in Anon Proxy Server 0.104. An attacker can embed malicious JavaScript within a URL that, when opened by a user, is echoed back by the server and executed in the victim’s browser. This can lead to theft of session cookies, execution of arbitrary client‑side actions, and other typical XSS‑related damage. The weakness falls under CWE‑79, which denotes improper neutralization of user input that leads to cross‑site scripting.

The affected product is Anon Proxy Server, version 0.104. No other versions are listed as vulnerable in the current data.

The CVSS score of 5.1 places the vulnerability in the medium severity range. The EPSS score is less than 1%, suggesting that exploitation is currently unlikely to be widespread. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation. Exploitability requires a user to be tricked into clicking a crafted link or otherwise visiting a URL containing a malicious host parameter, so it is limited to client‑side attacks without privilege escalation or server compromise.