Improper neutralization of user‑supplied data during web page generation in Rolantis Information Technologies' Agentis allows an attacker to inject malicious code into HTML attributes, a form of cross‑site scripting (CWE‑79). The vulnerability can be triggered by submitting crafted input, resulting in arbitrary script execution when a user views the affected page. Such execution may facilitate session hijacking, credential theft, or phishing, affecting confidentiality, integrity and availability of user data.

The flaw affects Rolantis Information Technologies Tourism Industry and Trade Co. Ltd.'s Agentis product. Affected versions include all releases from 4.44 up to, but not including, 4.6. No other vendors or products are listed, and the vulnerability is specific to this application.

The CVSS score of 6.1 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, so exploitation probability is currently uncertain. Attackers can exploit the flaw by influencing inputs that become part of HTML attributes—such as query parameters, form fields or stored data—without needing special privileges. Once exploited, an attacker could execute scripts on victims’ browsers, potentially compromising user sessions or defacing content.