The vulnerability is a reflected cross‑site scripting flaw in the Search argument of the users.php script. By sending a specially crafted value to the Search parameter, an attacker can inject arbitrary JavaScript that executes in the context of any victim who visits the URL. The attacker may hijack sessions, deface content, or perform other client‑side attacks. The weakness is expressed by CWE-79 (XSS) and CWE-94 (Code Injection).

The affected product is the open‑source MateisHomePage‑Website maintained by coolbeans1212. All releases up to and including commit ea2a4226deeca27ab1fb9df0552ec76444547811 contain the vulnerable code in users.php. Continuous delivery is used, so the product is updated frequently and a fixed build is available via the patch commit 6406308df9771d2fd477b56dafe4878dd846df6e, but no specific version numbers are provided.

The CVSS base score of 5.3 indicates a moderate likelihood of exploitation. The EPSS value is not available, and the vulnerability is not listed in the CISA KEV catalog, but the exploit is publicly available on GitHub. Because the flaw can be triggered remotely by crafting a URL, an attacker only needs to supply a victim with a malicious link; no special privileges or authentication are required. The risk is that an attacker can execute arbitrary JavaScript in the victim browser, potentially stealing cookies or performing actions on behalf of the user.