Cross‑Site Scripting vulnerability in Altenar Sportsbook Software Platform version 2.0 lets an attacker embed malicious JavaScript into a URL parameter. When a user clicks the crafted link, the script executes in the victim’s browser under the application’s context, allowing the attacker to read sensitive page data or session information. The flaw aligns with information disclosure (CWE‑200) because the injected code can access and transmit confidential information, yet it does not grant server‑side code execution or system control.

Altenar Sportsbook Software Platform (SB2) v.2.0 is the only product referenced. Any deployment that serves the vulnerable endpoint from this version and exposes the reflected URL parameter is affected; no other vendors or product variations are listed.

The CVSS score of 6.1 indicates moderate severity, while the EPSS value of less than 1 % suggests low real‑world exploitation. The vulnerability is not present in the CISA KEV catalog. The attack originates remotely from an unauthenticated user who injects a specialized URL; successful exploitation leads to arbitrary JavaScript execution in the victim’s browser, enabling data theft or session hijacking but not providing server‑side control.