This vulnerability is a reflected cross‑site scripting flaw in the Anon Proxy Server 0.104. An attacker can send a malicious URL containing a crafted host parameter to the /diagdns.php endpoint. When a victim opens that URL, the server returns the host value unescaped, causing the browser to execute the embedded JavaScript. The attacker can then steal session cookies, read sensitive data, or perform actions on the victim’s behalf.

Affected products are the Anon Proxy Server from the vendor of the same name. The specific vulnerable release is version 0.104. Any deployments using this version are at risk, while newer releases are not mentioned as affected.

The CVSS score of 5.1 classifies the impact as moderate. The EPSS score is below 1 %, indicating a low likelihood of exploitation, and the issue is not listed in the CISA KEV catalog. The flaw is exploitable remotely via an HTTP request to a user‑supplied parameter, so an attacker only needs to lure a victim into clicking a crafted link.