This vulnerability is an HTML injection flaw that allows an attacker to embed arbitrary markup into the 'q' search parameter, leading to client‑side script execution within the context of the victim's browser. The flaw arises because the application fails to properly validate or escape user input before rendering it. The impact can compromise confidentiality, integrity, and availability of the user session through cross‑site scripting, potentially enabling session hijacking, data theft, or malicious content injection.

Affected products include Botble Athena, Homzen, Martfury, and TransP, all versions of each product. The issue is present in all current releases until patched by the vendor.

The CVSS score of 5.1 indicates a medium severity vulnerability, and the EPSS score of less than 1% shows a low probability of exploitation at the time of writing. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request to '/search' with a crafted 'q' parameter that contains malicious HTML. If exploited, an attacker could execute arbitrary JavaScript in the victim’s browser, enabling further cross‑site attacks.