Key Systems Inc Global Facilities Management Software contains a reflected cross-site scripting flaw at the /?Function=Groups endpoint. The vulnerability allows an attacker to craft a URL that injects arbitrary JavaScript through the selectgroup and gn parameters. When a user follows the malicious link, the script executes in the user's browser context. Based on the description, it is inferred that this could enable credential theft, session hijacking, or full compromise of the application.

The flaw affects the 20230721a release of Key Systems Inc Global Facilities Management Software. No other versions or vendors are listed as affected.

With a CVSS score of 7.6 the vulnerability is classified as high severity. The EPSS score of less than 1% indicates that the exploitation probability is currently low, yet the flaw is publicly documented and not listed in the CISA KEV catalog. The likely attack vector is the web, where an attacker sends a crafted HTTP/HTTPS request to the /?Function=Groups endpoint. Anyone who follows the malicious URL can trigger the flaw, making proactive mitigation advisable.