A flaw in the AppJsonTreeView component of welovemedia FFmate allows remote attackers to inject arbitrary script via a manipulation of input to the Webhook Handler, leading to cross-site scripting. The disclosure shows that an attacker could run malicious client-side code within a user’s browser session, potentially stealing session data or performing other malicious client actions. The vulnerability stems from reflected input handling failures (CWE‑79) and improper code execution pathways (CWE‑94). The evidence that the attack can be initiated remotely means an unauthenticated attacker can supply crafted requests to the vulnerable endpoint without needing privileged access.

The affected product is welovemedia FFmate, specifically the Webhook Handler component located in /ui/app/components/AppJsonTreeView.vue. Versions up to and including 2.0.15 are vulnerable; no further version information is provided.

The CVSS score of 5.1 indicates moderate severity. Exploit code is publicly available and the vulnerability can be triggered remotely, increasing the likelihood of abuse. Although the EPSS score is not listed and the issue is not in the CISA KEV catalog, the combination of a moderate CVSS score with a publicly disclosed exploit advises security teams to treat this as a notable threat. An attacker can deliver malicious scripts that execute in the context of any user who interacts with the vulnerable component, potentially leading to session hijacking or defacement.