An attacker can inject arbitrary URLs into the title field of Timo 2.0.3, causing the stored value to be rendered with executable JavaScript in a user’s browser. This vulnerable input handling enables cross‑site scripting, which could lead to theft of session tokens, defacement, or the execution of malicious code in the context of a legitimate user’s session.

The vulnerability affects Timo version 2.0.3 developed by AuntVT. No other vendors or product versions are listed.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The issue is not listed in CISA’s KEV catalog, and no active public exploits have been reported. The attack vector is inferred to be a local user or an authenticated actor who can create or edit titles, leading to stored XSS in other users’ browsers.