iCMS v8.0.0 contains a reflected cross‑site scripting flaw in the User Management component. The vulnerability is triggered through the regip or loginip parameters in the index.html interface, enabling a remote attacker to inject and execute arbitrary HTML or JavaScript in the browser of any user who visits the compromised page. Such exploitation can lead to session hijacking, cookie theft, defacement, or delivery of malicious payloads to unsuspecting users.

The affected product is idreamsoft iCMS version 8.0.0. No other vendors or product variants are listed as impacted.

With a CVSS score of 6.1 the issue is considered moderate severity. The EPSS score is below 1 % and the vulnerability is not catalogued in the CISA KEV list, suggesting low likelihood of widespread active exploitation. Based on the description the attacker can trigger the flaw from any external location by sending a crafted HTTP request containing malicious content in the regip or loginip parameters, without requiring authentication or privileged access.