This vulnerability is a Cross Site Scripting (CWE-79) issue affecting the fuint Member Marketing System up to version 1.0. It arises from improper input handling in the ClientMessageController.java component, enabling remote attackers to inject and execute arbitrary code in the context of a user's browser. The CVSS vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to information disclosure and integrity compromise of user data within the affected system. There is no indication of availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is documented, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected component or applying input validation controls if feasible.