The vulnerability is an improper neutralization of user-supplied input during web page generation, resulting in a reflected cross‑site scripting flaw (CWE‑79). An attacker can embed malicious scripts in URLs or form parameters that are echoed back to the browser, potentially allowing execution of arbitrary JavaScript in the context of the victim’s session. This can lead to theft of authentication credentials, manipulation of page content, or phishing attacks against users who click on crafted links.

Kulga Software and Telecommunications Limited Company’s Kulga News Software is affected from version 26.7.4 through any release before 26.10.0. Users running these configurations are vulnerable until the software is upgraded to 26.10.0 or later.

The CVSS score of 6.1 categorizes the issue as moderate severity. EPSS data is not available and the vulnerability is not currently listed in CISA’s KEV catalog, indicating no confirmed exploitation at this time. The attack vector is inferred to be remote, relying on a maliciously crafted request that a victim’s browser processes; therefore, any publicly exposed instances of Kulga News Software that accept user input without proper escaping are at risk.