An attacker can inject malicious scripts into DernekWeb through an improperly neutralized input field. The payload is stored in the application database and later rendered within the web pages of the application, allowing the attacker to execute arbitrary scripts in the browsers of users who view the affected content. This vulnerability can lead to session hijacking, credential theft, or defacement of the site.

DernekWeb, a product of Basamak Information Technology Consulting and Organization Trade Ltd. Co., is vulnerable in all releases up to version 30122025.

The flaw carries a CVSS score of 8.8, indicating a high severity. No EPSS score is publicly available, and it is not listed in the CISA KEV catalog. The likely attack vector is via web forms or other mechanisms that allow users to submit content that is later displayed to others without proper encoding. Exploitation requires the ability to submit data that the application stores and renders, and a victim who views the stored content will receive the malicious script.