A flaw in the internal Message Module of Qibo CMS 1.0 allows an attacker to inject arbitrary script or HTML when manipulating messages, resulting in cross‑site scripting when the affected user views it. The vulnerability is exploitable through normal web requests and can execute code within the victim’s browser context.

Qibo CMS 1.0, specifically the internal Message Module. The vendor, Qibo, has not issued a fix and has not responded to the disclosed vulnerability.

The CVSS score of 5.1 indicates moderate severity, and while the EPSS score is not available, the exploit has been made public, suggesting that attackers can readily target the vulnerability. The flaw can be triggered remotely, and the lack of a vendor fix or KEV listing increases the risk of ongoing exploitation. Given the remote nature of the attack vector, any user who views a crafted message could have their browser session hijacked or other malicious actions performed. The CVE description does not specify authentication requirements, implying that the vulnerability may affect all users who access the affected functionality.