The vulnerability is a stored XSS flaw where untrusted input is reflected in HTTP responses without sanitization. An attacker could inject JavaScript that executes in the context of other users’ browsers, potentially enabling session hijacking, data theft, or defacement of the web interface. The weakness is a classic client‑side injection (CWE‑79).

The susceptible component is the fmDNS module of the facileManager suite. All installations of facileManager prior to version 6.0.4 are affected; the issue is resolved in 6.0.4 and later releases.

With a CVSS score of 7.6 the vulnerability is classified as high severity. The EPSS score is below 1%, indicating low predicted exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker inserting a malicious payload into a field accepted by the fmDNS module, which is then persisted and later rendered in another user’s browser. No specific prerequisites beyond authenticated access to the module are stated, so the risk profile is medium‑to‑high if user accounts have privileged permissions.