This vulnerability involves improper sanitization or validation of the Report Title parameter in the /report/addreport endpoint of CodeAstro Complaint Management System 1.0. An attacker can manipulate this parameter to inject malicious scripts, leading to cross-site scripting attacks. The vulnerability requires only network access and no user interaction beyond limited privileges, making remote exploitation feasible. The vulnerability is publicly known, but no official fix or patch has been published yet.

Successful exploitation of this vulnerability enables an attacker to execute arbitrary scripts in the context of the victim's browser when they access the vulnerable endpoint. This can lead to session hijacking, defacement, or other malicious actions performed on behalf of the victim user. The impact is limited by the requirement of limited privileges and user interaction, and there is no indication of further privilege escalation or system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard XSS mitigations such as input validation and output encoding on the Report Title parameter if possible. Monitoring for suspicious activity related to the /report/addreport endpoint is recommended. No vendor-provided official fix or temporary workaround is currently documented.