An input validation flaw allows an attacker to inject malicious script directly into the HTML response through unescaped query string parameters. This reflected cross‑site scripting can cause a victim’s browser to execute arbitrary code, enabling credential theft, session hijacking, and other client‑side attacks. The weakness falls under CWE-79.

The vulnerability affects InstantASP Ltd’s InstantForum.NET version 4.1.4.

No EPSS data is available, and the issue is not listed in CISA KEV. Although a formal CVSS score is not provided, the nature of reflected XSS generally scores high in severity. Exploitation requires only constructing a URL that the victim visits, making the attack trivial for a web‑based threat actor. The absence of mitigation info suggests that the risk remains significant until a patch or work‑around is applied.