This vulnerability in Zoho Billing involves improper neutralization of input during web page generation, leading to a DOM-based Cross-site Scripting (XSS) flaw. An attacker with low privileges and requiring user interaction can exploit this vulnerability remotely over the network. The CVSS 3.1 base score is 6.5, reflecting medium severity with impacts on confidentiality, integrity, and availability. The affected product versions include all versions up to 4.1. No official patch or remediation details have been provided at this time.

Successful exploitation of this DOM-based XSS vulnerability can lead to limited confidentiality, integrity, and availability impacts within the Zoho Billing application. An attacker could potentially execute malicious scripts in the context of a victim user, which may result in unauthorized actions or data exposure within the application scope. However, exploitation requires user interaction and low privileges, which limits the overall impact severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider applying any recommended workarounds from Zoho once published. Monitor official Zoho Subscriptions advisories for updates on patches or mitigations.