This vulnerability involves a reflected XSS in the parent parameter of the index page in vTiger CRM 7.4.0. An attacker can craft a malicious payload that, when processed by the vulnerable parameter, executes arbitrary code in the victim's browser session. The CVSS vector indicates the attack can be performed remotely over the network without privileges and requires user interaction. The impact is limited to integrity compromise via code injection, with no confidentiality or availability impact noted. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation allows an attacker to execute arbitrary code in the context of the user's browser, potentially leading to session hijacking, defacement, or other malicious actions impacting the integrity of the user's interaction with the application. There is no direct impact on confidentiality or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input and consider implementing web application firewall (WAF) rules to detect and block malicious payloads targeting the parent parameter. Avoid clicking suspicious links that may exploit this vulnerability.