The application contains a flaw that allows an attacker to inject arbitrary client‑side scripts via the "/?_route=settings/users-view/" endpoint. The input is reflected in the page without proper encoding, making it possible for an attacker to run malicious code in the browser when a user views the profile page. While the impact is limited to the victim’s browser, the injected code can steal session tokens, modify page content, or trigger phishing actions. The vulnerability is a classic reflected XSS that can be performed remotely by sending a crafted HTTP request to the exposed route. The attacker need only access the web interface and can target any user who visits the affected page. Because it is not a privilege‑escalation flaw, the risk is confined to the client side but can lead to credential theft and further attacks. The CVSS score of 4.8 reflects a low severity overall, yet the lack of a mitigated environment and the potential for exploitation could have significant operational impacts. No exploit probability data are published, and the vulnerability is not in the CISA KEV list, implying limited known exploitation at this time.

The affected product is BichitroGan ISP Billing Software version 2025.3.20. The vulnerability resides in the Profile Page Handler component, specifically the "settings/users-view" route. Users of this version who access the affected page are at risk of client‑side compromise. No other vendors or versions are listed in the current data.

The CVSS score of 4.8 indicates a low severity, but the remote nature of the attack means an external party can trigger the injection by simply sending a crafted HTTP request. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread or confirmed exploitation at present. The risk is limited to the victim’s browser session; however, compromised sessions can lead to credential theft, unauthorized actions performed in the user’s context, and phishing. Since no privilege escalation is involved, the overall system integrity remains intact. Given the low score but potential for credential and session hijacking, the vulnerability should be addressed promptly.