An input validation flaw allows an attacker to inject malicious script directly into the HTML response through unescaped query string parameters. This reflected cross‑site scripting can cause a victim’s browser to execute arbitrary code. The weakness falls under CWE-79.

The vulnerability affects InstantASP Ltd’s InstantForum.NET version 4.1.4.

The EPSS score is <1%, indicating a low probability of exploitation, and it is not listed in the CISA KEV catalog. The CVSS score is 5.4, indicating moderate severity. Exploitation requires constructing a URL that the victim visits; the level of triviality of this vector is inferred but not explicitly confirmed in the advisory. The absence of mitigation info suggests that the risk remains significant until a patch or work‑around is applied.