A flaw in GotoHTTP version 10.2 and earlier allows an attacker to supply a specially crafted value for the sn argument in the /reg.12x endpoint. The server improperly echoes this value back to the client, enabling stored or reflected cross‑site scripting (CWE‑79). If a malicious script is injected, it can run in the context of any user who loads the affected page, potentially stealing session cookies or defacing content. The vendor notes that the URL is not intended for browser use and claims no security impact, yet the CVSS rating of 5.3 reflects the potential for client‑side compromise.

The vulnerability is present in the open‑source GotoHTTP application, specifically for releases up to and including 10.2. No other version range is documented; any installation running a 10.2 build or earlier should be considered vulnerable.

The CVSS score of 5.3 classifies the issue as moderate in severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known large‑scale exploitation. However, because the flaw can be triggered remotely via a crafted sn parameter, an attacker could potentially embed arbitrary client‑side code. Exploitation requires only HTTP access to the /reg.12x endpoint, so the attack surface is wide. The impact depends on whether users load the affected page; if they do, client‑side compromise is possible.