This vulnerability in epeken Epeken All Kurir (<= 2.0.1) is a DOM-based cross-site scripting issue caused by improper neutralization of input during web page generation. It allows an attacker with network access and low privileges to execute scripts in the victim's browser when the victim interacts with malicious content. The CVSS 3.1 score is 6.5, reflecting medium severity with impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and the product is not a cloud service.

Successful exploitation could lead to execution of arbitrary scripts in the context of the affected application, potentially allowing an attacker to steal information, manipulate data, or disrupt availability to a limited extent. The vulnerability requires user interaction and low privileges, which limits the attack vector. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider implementing input validation or output encoding as a temporary mitigation. Monitor vendor channels for updates regarding patches or official mitigations.