This vulnerability in ComMotion Course Booking System (versions <= 6.1.2) involves improper neutralization of input during web page generation, leading to reflected cross-site scripting (XSS). An attacker can craft malicious input that, when reflected by the web application, executes in the context of the victim's browser. The CVSS 3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in the victim's browser, potentially allowing theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of user data. The reflected nature means the attack requires the victim to interact with a crafted link or input. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted input and avoid clicking suspicious links. Vendors and users should monitor for official patches or updates addressing this vulnerability.