The vulnerability is an improper neutralization of input during web page generation that permits an attacker to inject malicious scripts. It falls under CWE‑79 and results in reflected Cross‑Site Scripting. When triggered, the injected script runs in the victim’s browser with the privileges of the affected account, enabling attacks such as session hijacking, credential theft, defacement, or the execution of arbitrary JavaScript. The impact therefore spans confidentiality, integrity, and availability of the web application and its users.

Gosoft Software Industry and Trade Ltd. Co. Proticaret E-Commerce versions starting at v5.0.0 up to but not including v6.0.1767.1383 are affected. This includes any releases in that range that have not yet been updated to the fixed version.

The CVSS score of 8.8 indicates a high severity and suggests significant exploitation impact. EPSS data is not available, but the lack of a KEV listing does not mitigate the risk, as the vulnerability remains present in many deployed instances. The attack vector is likely through user‑controlled query parameters or form fields that are reflected directly in the generated page. An attacker can send a crafted URL or POST data to a victim’s browser, causing malicious script execution without additional privileges.