This vulnerability involves a reflected XSS in vTiger CRM 7.4.0 where the tag parameter on the index page does not properly sanitize user input. An attacker can craft a URL containing malicious script code in the tag parameter, which when visited by a user, executes arbitrary code within the user's browser session. This can lead to impacts such as session hijacking or other script-based attacks. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, no confidentiality impact, high integrity impact, and no availability impact. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an attacker to execute arbitrary code in the victim's browser context, potentially leading to unauthorized actions or data manipulation within the user's session. The integrity of user interactions can be compromised, but confidentiality and availability impacts are not indicated. This could facilitate further attacks such as session hijacking or phishing within the affected application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should exercise caution when interacting with URLs containing the tag parameter in vTiger CRM 7.4.0. Implementing web application firewalls (WAF) with XSS filtering rules may provide temporary mitigation. Avoid clicking on untrusted links and consider restricting access to the affected application to trusted users only.