The vulnerability resides in the edit profile feature of the robo‑cafe‑rms application. By manipulating the Name, Address, or City arguments submitted to frontend/update‑account.php, an attacker can inject unescaped JavaScript code, resulting in a cross‑site scripting flaw. The flaw allows remote exploitation and the public availability of an exploit means attackers can execute arbitrary scripts in the context of the victim’s browser.

Affected systems include any deployment of mwasikz robo‑cafe‑rms built from code up to commit 228c44a02823f04e85db32b7137809a2856148fc. The product follows a rolling‑release delivery model, so precise version information is not bundled; vendors and users should review the repository for the latest commit that includes the patch.

The CVSS score of 5.1 indicates medium severity, and the EPSS score is not available, though the lack of CISA KEV listing suggests the vulnerability has not been widely exploited in the wild yet. Nevertheless, because the attack is remote and a public exploit exists, the risk remains significant. Attackers can target any accessible instance that fails to sanitize user input, so applying the patch immediately or mitigating input validation is essential.