The vulnerability is a classic Cross‑Site Scripting flaw in the GSVoIP web panel. The msg parameter in /painel/gateways.php/error is not properly sanitized, allowing an attacker to embed arbitrary JavaScript within the HTML response. When a victim opens the malicious link, the injected scripts run in their browser with the same origin as the site. This can lead to session hijacking, theft of credentials, phishing, or the execution of other malicious client‑side actions. The flaw does not affect the server directly, but it compromises the confidentiality, integrity, and availability of users interacting with the interface.

Affected systems are installations of the GSVoIP web control panel from Solutionsvoip, specifically version 2.0.90. The vulnerability is exposed by sending a crafted request to the /painel/gateways.php/error endpoint, so any publicly accessible instance running this version is at risk.

The CVSS score of 6.1 denotes a medium severity XSS flaw, and the EPSS score is not available. The flaw remains a remote, client‑side vulnerability that can be invoked by any user visiting the page without authentication. Although it is not listed in CISA’s KEV catalog, the potential for session hijacking, credential theft, or phishing from injected scripts requires prompt attention.