The catkin ReDi Restaurant Reservation product contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. This vulnerability affects all versions up to and including 24.1209. Exploitation requires user interaction (UI:R) and can be performed remotely without privileges (AV:N, PR:N). The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with impacts on confidentiality, integrity, and availability. No vendor patch or advisory is currently available.

Successful exploitation of this reflected XSS vulnerability can allow attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to partial disclosure of sensitive information, modification of web content, and disruption of availability. The CVSS vector indicates low attack complexity and no required privileges, increasing the risk. However, no known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or output encoding workarounds if feasible. Monitor vendor channels for updates and apply patches promptly once available.