This vulnerability in nrmendez CRM 2go (versions up to 1.0) involves improper neutralization of input during web page generation, resulting in a DOM-based Cross-site Scripting (XSS) flaw. An attacker with at least low privileges and requiring user interaction could exploit this to execute arbitrary scripts in the victim's browser. The CVSS score is 6.5 (medium), reflecting network attack vector, low attack complexity, required privileges, user interaction, and impacts on confidentiality, integrity, and availability at a low level. No patch or vendor advisory is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to limited disclosure or modification of information and disruption of service. The impact is rated medium due to the combination of attack vector, required privileges, and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply general best practices such as limiting privileges and exercising caution with untrusted input. No vendor advisory or patch links are currently provided.