This vulnerability is a classic cross‑site scripting flaw that permits an attacker to inject arbitrary scripts into the web page delivered to a visitor of the MATCHA SNS site. If an attacker successfully supplies malicious input that is not properly escaped, that script will execute in the victim’s browser with the privileges of the page, potentially compromising sensitive data or performing actions on behalf of the user.

ICZ Corporation’s MATCHA SNS version 1.3.9 and all earlier releases are affected. Users running these or earlier builds are exposed to the threat

The CVSS score of 5.1 indicates moderate severity; the EPSS value is not available and the vulnerability has not been listed in CISA’s KEV catalog, suggesting no known wide‑scale exploitation to date. The likely attack vector involves an attacker posting or submitting malicious input that the site reflects without sanitization, which can be exploited by any user who visits the vulnerable page. While no known exploits are publicly documented, the presence of a browser‑based code execution path presents a significant confidentiality and integrity risk if the site is frequently visited by authenticated users or administrators.