This vulnerability in MiKa OSM (up to version 6.1.2) is due to improper neutralization of input during web page generation, allowing for Cross-site Scripting (XSS) attacks. An attacker with low privileges can trick a user into executing malicious scripts via crafted input that is not properly sanitized. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges are low, user interaction is required, and the scope is changed with limited impact on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially allowing theft of session tokens, modification of web content, or other actions within the user's context. The impact is rated medium with limited confidentiality, integrity, and availability impacts. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider applying web application firewall rules or input sanitization as temporary mitigations. Monitor vendor channels for updates.