The vulnerability is a reflected cross‑site scripting flaw in the ICTBroadcast software’s login.php endpoint. The editForm[extension_username] parameter is written back to the response without proper filtering, allowing an attacker to inject malicious JavaScript that will execute in the victim’s browser when the crafted URL is visited.

Affected systems are deployments of ICT Innovations’ PHP‑CGI/PHP‑FPM configuration, particularly those running the demo environment of ICTBroadcast. No specific version numbers are listed; the issue applies to all installations using the vulnerable login.php endpoint.

The CVSS score of 5.1 indicates moderate severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploit at this time. Exploitation requires an attacker to lure a victim to a malicious URL; no privileged access or other conditions are described, implying that the impact is limited to the victim’s browser. Nonetheless, because the flaw allows arbitrary JavaScript execution, conditional on victim interaction it can lead to cookie theft, session hijacking or defacement.