The codetipi Valenti Engine up to version 1.0.3 suffers from a DOM-based Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. This allows an attacker with at least low privileges and user interaction to execute malicious scripts in the context of the affected web application. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to execution of arbitrary scripts in the victim's browser, potentially resulting in partial disclosure of information, modification of data, or disruption of service within the affected application context. The impact is limited to the scope of the web application using Valenti Engine and requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying any recommended workarounds from the vendor or limit exposure by restricting access or input vectors that could trigger the vulnerability. Monitor vendor channels for updates.