The CVE describes an improper neutralization of input during web page generation that results in reflected XSS in Inrove Software’s BiEticaret. The vulnerability allows malicious scripts to be executed in the victim’s browser when a crafted request is reflected by the application. While the issue does not enable arbitrary code execution on the server, the injected client‑side scripts could be used to steal authentication cookies, hijack sessions, or manipulate displayed content. These possible consequences are inferred from the nature of reflected XSS.

BiEticaret from Inrove Software and Internet Services prior to version 3.3.57 is affected. The flaw exists in the web application’s handling of user input that is reflected without proper escaping.

The CVSS score of 6.1 indicates a moderate risk, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the most likely attack vector is a malicious link or request that an authenticated or unauthenticated user follows or submits, leading to execution of the reflected payload in their browser.