The vulnerability CVE-2024-49663 affects elenkadark uCAT – Next Story (versions <= 2.0.0) and is classified as a reflected cross-site scripting (XSS) flaw. It occurs due to improper neutralization of user-supplied input during the generation of web pages, enabling attackers to inject and execute arbitrary scripts in users' browsers. This can lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. The CVSS 3.1 base score is 7.1, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability rated low to low. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this reflected XSS vulnerability can allow attackers to execute arbitrary scripts in the context of users' browsers, potentially leading to theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability. The CVSS score of 7.1 reflects a high severity level, but no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or output encoding workarounds if feasible. Monitoring vendor channels for updates is recommended. No official fix or temporary workaround is currently documented.