The vulnerability in Beyaz Computer’s CityPLus allows an attacker to inject malicious scripts that are reflected back to the victim’s browser. Although it does not compromise the server itself, the reflected XSS can lead to session hijacking, cookie theft, defacement, or execution of arbitrary JavaScript within the context of the target user. The weakness corresponds to CWE‑79 and requires proper neutralization of user input when generating dynamic web pages.

Beyaz Computer Software Design Industry and Trade Ltd. Co. product CityPLus, versions prior to V24.29750.1.0, are affected. No additional vendors or versions are listed.

The CVSS score of 7.6 classifies this issue as high severity. EPSS data is not available, and the vulnerability is not currently listed in CISA KEV. The likely attack vector is a web request that contains malicious input; a remote attacker can exploit it by crafting a URL pointing to CityPLus’s web interface to deliver the malicious script. The impact is restricted to victim users who load the affected page. Based on the CVSS, the risk is significant, especially in environments where CityPLus is exposed to untrusted actors.