The vulnerability is a reflected cross‑site scripting flaw in the dashboard search feature of VertiGIS FM. A maliciously crafted URL can contain arbitrary JavaScript that is executed in the browser when an authenticated user opens the link. This enables attackers to run scripts in the victim’s browser session, potentially stealing session cookies, injecting malicious content, or performing unauthorized actions within the application.

The issue affects the VertiGIS FM solution as distributed by VertiGIS. No specific version information is provided by the CNA; the vulnerability applies to any installation that includes the affected dashboard search functionality. The CPE strings identify the product as vertigis:fm and vertigis:vertigis_fm.

The CVSS score of 7.3 indicates high severity. The EPSS score is below 1 %, suggesting that widespread exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the flaw can be triggered by a simple link click, requiring only that the victim is authenticated and visits the crafted URL. This combination of low effort and high impact makes the risk moderate to high, especially within organizations where users routinely access internal dashboards.