A cross‑site scripting flaw exists in the Endpoint /logs component of elecV2P, triggered by manipulating the filename argument passed to the logs module. The vulnerability is characterized by CWE‑79 (Output Encoding) and CWE‑94 (Improper Control of Generation of Code by a Feature) weaknesses, enabling attackers to inject malicious script code that will execute within the browser of any user who views the affected log entry. This can lead to session hijacking, credential theft, defacement, or the execution of further client‑side attacks without requiring authentication.

The flaw affects elecV2P versions up to and including 3.8.3. The specific component is the /logs endpoint, which may be exposed over the network to external users. Administrators operating these versions should verify their deployment and confirm whether the vulnerable code path is active.

The reported CVSS score of 5.3 indicates a moderate impact, and the EPSS score is not available. The vulnerability is not present in the CISA KEV catalog, but it has been publicly disclosed and could be exploited by sending a crafted request to the exposed endpoint. Because the attack vector is remote and does not require authentication, there is a realistic risk of widespread exploitation if the endpoint remains accessible to untrusted actors.