This vulnerability in rhizomaticweb RWS Enquiry And Lead Follow-up (<= 1.0) is caused by improper neutralization of input during web page generation, resulting in a reflected cross-site scripting (XSS) flaw. An attacker can craft a malicious URL or input that, when processed by the affected application, causes execution of arbitrary scripts in the context of the victim's browser session. The CVSS 3.1 score of 7.1 reflects network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the context of the victim's browser, potentially resulting in theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability. The reflected nature of the XSS means the attack requires user interaction, such as clicking a crafted link. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should exercise caution with untrusted input and avoid clicking suspicious links. Application developers should implement proper input validation and output encoding to neutralize potentially malicious input during web page generation.