The reported weakness is a cross site scripting vulnerability located in the Pool List Interface of BichitroGan ISP Billing Software. A manipulated request to the route /?_route=pool/add can inject script content that will be executed by a victim’s browser when viewed. The flaw is documented as a CWE‑79 XSS and also involves potential code injection (CWE‑94). Adversaries can trigger the flaw remotely, and the exploit is publicly available, meaning immediate exposure is possible with no prerequisite access.

This issue impacts the BichitroGan ISP Billing Software, specifically version 2025.3.20. The affected component is an otherwise undocumented function in the Pool List Interface; no further sub‑components are identified. The vendor, BichitroGan, has not yet responded to the disclosure.

The CVSS score of 4.8 indicates moderate severity; however, the exploit is freely available and can be performed from a remote machine, implying a realistic attack surface for any organization using the affected version. The EPSS score is not available, so the precise likelihood of exploitation is unknown, but the lack of vendor response and the public disclosure increase concern. The vulnerability is not listed in the CISA KEV catalog, yet its remote XSS nature can lead to credential theft, defacement, or deflection of user traffic. Potential attackers would target the web interface of the billing system, likely bypassing authentication or exploiting unauthenticated access if not properly secured.