The vulnerability involves the platform failing to neutralize input during web page generation, which allows attackers to inject malicious scripts that are reflected in the browser response, enabling code execution in the context of a victim’s browser. The weakness stems from improper output encoding and is classified as CWE‑79.

The vulnerability affects all installations of Ticimax Informatics Technologies Inc.’s Ticimax E-Commerce Platform through 2026-09-02. No specific version numbers are listed, so any current deployment is presumed at risk until a patch is applied.

The CVSS score of 6.1 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not included in the CISA KEV catalog, suggesting no known active exploitation yet. The likely attack vector is through reflected input in URLs or form fields. The risk remains moderate but requires mitigation to prevent potential harm.