A reflected cross‑site scripting flaw in the AdvancedSearch feature of Silverpeas Core allows an attacker to embed malicious JavaScript into responses that are returned to the user – the code executes in the victim’s browser context. The primary impact is the ability for an attacker to run arbitrary scripts within the context of any user who views the reflected payload.

Silverpeas Core installations running any version earlier than 6.4.6 are affected. No other vendors or product lines are explicitly listed as impacted.

The vulnerability is a reflected XSS that requires an attacker to supply crafted input, typically via a link or form, that the application reflects back in the browser. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The CVSS score of 6.1 indicates a moderate risk level when exploited. The likely attack vector involves a user following a maliciously constructed URL containing the reflected script.