This vulnerability in Truong Thanh ATP Call Now (versions <= 1.0.3) involves improper neutralization of input during web page generation, leading to a Stored Cross-site Scripting (XSS) issue. The CVSS 3.1 score is 5.9 (medium), with an attack vector of network, low attack complexity, requiring high privileges and user interaction, and impacts confidentiality, integrity, and availability at a low level. The vulnerability is published but no patch or remediation details are provided in the available data.

Successful exploitation could allow an attacker with high privileges and user interaction to inject and execute malicious scripts in the context of the vulnerable application, potentially leading to limited confidentiality, integrity, and availability impacts. However, no known exploits are reported in the wild, and the impact is assessed as medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with input handling and consider restricting high privilege user interactions where feasible. Monitor vendor communications for updates on patches or mitigations.