The vulnerability is an improper sanitization bug in the phpBB registration module that allows a reflected Cross‑Site Scripting (XSS) attack. This flaw permits an attacker to inject malicious JavaScript into a response that is displayed to users, enabling session hijacking, defacement, or data theft. The weakness corresponds to CWE-79.

The affected vendor is phpBB, product phpBB. Specific impacted versions have not been disclosed in the available data.

The CVSS score of 8.3 classifies this flaw as a high‑severity vulnerability. The EPSS score is not available, and the flaw is not listed in CISA's KEV catalogue. Based on the description, the likely attack vector is a reflected XSS triggered via a crafted registration request that includes malicious input. Exploitation requires the victim to visit a URL containing malicious payload; no authentication or elevated privileges are needed. The threat remains significant due to the ease of exploitation and potential for widespread damage.