The vulnerability is a reflected XSS flaw caused by improper neutralization of user‑supplied input during page rendering in Akinsoft’s e‑Commerce platform. An attacker can embed malicious script payloads in URLs or form submissions that are reflected back in the response, enabling theft of session cookies, defacement, or phishing attacks. This weakness aligns with CWE‑79 and compromises confidentiality, integrity, and potentially availability if the injected script triggers further malicious activity.

The affected product is Akinsoft’s e‑Commerce application, versions prior to 1.25.01.06. Administrators should verify that their deployed instances are not running a susceptible version and review vendor release notes for the applicable fix.

The CVSS score of 6.1 indicates moderate risk; the EPSS score is not available, so current exploitation probability cannot be determined. The vulnerability is not listed in CISA’s KEV catalog, suggesting no documented exploits yet. The likely attack vector is web‑based, requiring an attacker to craft a URL or form that the application reflects without sanitization, which can be achieved simply by visiting a malicious link or submitting a form containing a payload. Accordingly, the risk is moderate but non‑trivial, especially for publicly exposed instances.