HostBill v.2025-11-24 and 2025-12-01 contain a cross‑site scripting (XSS) flaw that permits a remote attacker to run arbitrary code. The vulnerability arises when untrusted input is reflected or stored in the application’s admin and client interfaces without proper sanitization, allowing a malicious payload to be delivered to an affected user. Executing such payloads can grant the attacker unauthorized control over the victim’s browser session and potentially the underlying system if the code runs with higher privileges.

The affected systems are HostBill web applications deployed with the 2025‑11‑24 or 2025‑12‑01 releases. Admin or client users who view pages that incorporate legacy or unsanitized input may be able to trigger the XSS vector.

The CVSS score of 4.9 indicates moderate overall risk, while the EPSS score of less than 1% suggests a low likelihood of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a web‑based exploitation where an attacker crafts a malicious script and induces vulnerable users to view a page that contains the payload. Because the flaw can lead to arbitrary code execution, the potential impact on confidentiality, integrity, and availability is significant for any compromised user session.