A cross‑site scripting flaw exists in the Model.getDomain function of Dianping CAT. The vulnerability arises when attackers manipulate the domain argument supplied to the hourlyReport.tag component, causing arbitrary script injection to be rendered in web pages. While the flaw is client‑side, it enables an attacker to run malicious JavaScript in the victim’s browser, potentially hijacking user sessions, stealing credentials, or executing other malicious actions within the scope of the compromised domain. The flaw is exploitable remotely via crafted HTTP requests and has already been publicly disclosed, indicating that it can be used in real‑world attacks.

The issue affects Dianping CAT versions 3.0.0, 3.1.0, and 4.0‑RC1. Only the Report Handler component, specifically the WEB‑INF/tags/hourlyReport.tag file, is impacted. Other product components are not known to be vulnerable.

The CVSS score of 5.3 places the vulnerability in the moderate risk range. The EPSS score is not available, yet the fact that an exploit has been publicly disclosed and the vulnerability can be triggered remotely suggests a realistic threat level. The vulnerability is not listed in CISA’s KEV catalog, but attackers may still leverage it through web browsers. The likely attack vector is a remote user sending a request to the Report Handler endpoint with a malicious domain value that causes script injection when the resulting page is viewed by a user.