GRR, a resource management and reservation application, contains a reflected cross‑site scripting vulnerability in the maj.php page. The forcemaj request parameter is returned in the page without proper escaping when installation files remain accessible, allowing an attacker to inject arbitrary JavaScript into a victim's browser. This client‑side code execution can be used to create phishing pages, redirect users to malicious sites, steal authentication cookies, and hijack user sessions. The weakness follows CWE‑79, demonstrating improper handling of user‑supplied data.

Affected editions of the GRR application are all releases prior to version 4.5.0, provided the installation files were not removed after deployment. Users running the open‑source product from the JeromeDevome development repository should verify their current version against the 4.5.0 milestone to determine if the flaw is present.

The vulnerability scores a CVSS of 8.1 and has no EPSS rating available. It is not listed in the CISA KEV catalog. Exploitation can occur remotely via a crafted URL that a victim clicks or visits without needing authentication; the attacker may further capture the session cookie because it is not marked HttpOnly. The lack of protection of installation files creates a low barrier to exploitation, making it a high‑risk issue for any publicly accessible deployment.