The vulnerability is a reflected Cross‑Site Scripting flaw in the detail_produk.php component of RafyMrX TOKO‑ONLINE‑ROTI v.1.0. Because the page outputs user‑supplied data without proper sanitization, a crafted request can inject arbitrary JavaScript, which the attacker can then execute in the victim’s browser. This can lead to session hijacking, defacement, theft of sensitive data, and compromise of the confidentiality and integrity of the application for users who visit the vulnerable URL.

The affected system is the RafyMrX TOKO‑ONLINE‑ROTI e‑commerce application, version 1.0, specifically the detail_produk.php page that displays product details. No other products or versions are listed as affected, and the vendor’s CNA information is not provided.

The CVSS score of 6.1 indicates moderate‑to‑high risk for an XSS flaw. The EPSS score is 0.00055, indicating a very low exploitation probability. The vulnerability is not in the CISA KEV catalog. The likely attack vector is remote: an attacker can deliver a malicious URL or manipulate the query string of a product detail page. Once a victim’s browser processes the injected script, the attacker can hijack the session, deface the site, or exfiltrate information.