The vulnerability arises from improper neutralization of user input during web page generation, allowing reflected cross‑site scripting. Attackers who persuade users to visit a crafted URL can inject malicious scripts that execute in the victim’s browser session. This can lead to cookie theft, session hijacking, defacement, or redirection to phishing sites, compromising the confidentiality and integrity of the affected web application.

Akıllı Ticaret Software Technologies Ltd. Co. offers an E‑Commerce Pack product, and all installed versions through October 2026 are affected. No specific sub‑versions are listed, so any deployment of the product from its inception to the stated date is at risk.

The CVSS score of 6.1 indicates a moderate severity vulnerability. The EPSS score is not provided, so the exact likelihood of exploitation cannot be determined from this data. The issue is not currently listed in CISA’s KEV catalog. Because the flaw is a reflected XSS, the likely attack vector involves a malicious link or sympathetic web page that the user visits, triggering the injection of executable JavaScript into the browser.