This vulnerability in Calvaweb Password only login (versions up to 0.2) involves improper neutralization of input during web page generation, resulting in a reflected cross-site scripting (XSS) flaw. An attacker could craft a malicious URL or input that, when processed by the vulnerable component, executes arbitrary scripts in the victim's browser session. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability to a limited extent. The reflected nature of the XSS requires user interaction to trigger the payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted input or URLs related to the Password only login component. No vendor-provided mitigation or temporary fix is currently documented.