The vulnerability is a reflected cross‑site scripting flaw in the namecontains parameter of diskover‑community's public/selectindices.php page. An attacker can embed arbitrary JavaScript that is executed in the victim's browser when the user accesses a crafted URL. The flaw is limited to client‑side code execution and is associated with CWE‑79.

Any deployment of diskover‑community version 2.3.5 or earlier is affected. No additional vendor or product information is specified.

The CVSS score of 6.1 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, implying rare exploitation. Exploitation requires an attacker to supply malicious input via the namecontains parameter and persuade a user to visit the URL, so the primary vector is unauthenticated web traffic. It does not provide remote code execution or privilege escalation on the server.