Improper neutralization of input during web page generation in Webbeyaz Web Design’s Mediküm Web leads to a reflected cross‑site scripting flaw. User‑supplied data that is reflected back to the browser is not properly encoded, allowing an attacker to inject malicious JavaScript that executes in the victim’s session. The impact includes credential theft, session hijacking, or other client‑side attacks, classified as CWE‑79.

The affected product is Webbeyaz Web Design’s Mediküm Web, with all releases up to and including the version dated 08‑07‑2026. The vendor has confirmed the product is no longer supported, meaning no official patch or update is available. Organizations using these versions remain exposed unless mitigated by other controls.

With a CVSS score of 6.1 the vulnerability is medium severity, while the EPSS score of less than 1 % indicates a very low exploitation probability. The flaw is not listed in the CISA KEV catalog. Exploitation would require an attacker to craft a request containing malicious input that the application echoes back in the response, typically via a phishing link or compromised form. No elevated privileges or additional network access are necessary beyond normal web traffic.