The vulnerability CVE-2026-22328 affects VamTam Auto Repair software versions up to 22.6. It is classified as CWE-79, indicating improper neutralization of input during web page generation, resulting in Cross-Site Scripting (XSS). The flaw can be exploited without authentication, allowing attackers to execute arbitrary scripts in the context of the affected application. The CVSS v3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch is currently available, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to execution of malicious scripts in users' browsers, potentially resulting in partial loss of confidentiality, integrity, and availability of the affected system or user data. Because the attack requires no authentication, it can be initiated by remote attackers over the network. The user interaction requirement means that exploitation depends on a user visiting a crafted web page or link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing web application firewalls or input validation controls as temporary mitigations. Monitor vendor channels for updates and apply patches promptly once available.