This vulnerability (CVE-2024-7787) in the vSRM Supplier Relationship Management System is due to improper input sanitization leading to reflected Cross-Site Scripting (CWE-79). An attacker can craft malicious input that is reflected in the web page response without proper neutralization, potentially executing arbitrary scripts in the context of the victim's browser. The issue affects versions prior to 28.08.2024. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of a user's browser session, potentially leading to session hijacking, defacement, or other client-side attacks. However, the impact is limited by the requirement for user interaction and the reflected nature of the XSS. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitoring vendor communications for updates is recommended.