The vulnerability resides in the ModuleFormService.save function where the Description argument is improperly escaped, allowing attackers to inject arbitrary script content into the web application. An injected script can execute within the victim’s browser, enabling session hijacking, defacement, or secondary attacks such as phishing. This weakness is identified by CWE-79 and could also involve executable code injection aspects identified by CWE-94.

1Panel-dev CordysCRM versions up to and including 1.4.1 are vulnerable. The fix was introduced in release 1.7.0, and the patch commit identifier is c87682afa8df79853299f75489c9d333f7bc5fce.

The CVSS score of 5.1 classifies the issue as moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the description states that an exploit has already been publicly disclosed and may be used. The attack can be initiated remotely by submitting a crafted Description value, and since it exploits a client-side scripting flaw, browsers that render the affected pages are a prerequisite.