Improper neutralization of input during web page generation results in a reflected cross‑site scripting vulnerability in MRV Technology Foreign Trade Ltd. Co.'s TurkHotspot. The flaw allows an attacker to craft input that is echoed back to the victim’s browser, enabling malicious script execution. Based on the description, it is inferred that an attacker could perform actions such as session hijacking, credential theft, or phishing. The issue applies to all builds up to 2026‑10‑02, and the vendor has confirmed the product is no longer supported, meaning there is no forthcoming patch.

The vulnerability is present in MRV Technology Foreign Trade Ltd. Co.'s TurkHotspot application through 2026‑10‑02. The vendor indicated that the product is no longer supported and does not offer a patch or update.

The CVSS score of 5.2 indicates moderate severity; the EPSS score is 0.00144, indicating a very low exploitation probability; and the vulnerability is not listed in the CISA KEV catalog. The likely attack path involves an attacker crafting a malicious URL or form value that the application echoes back without proper sanitization. Since no official fix exists, the risk remains until mitigative controls are applied or the application is replaced.