This vulnerability in skygroup Reebox is caused by improper input sanitization during web page generation, leading to reflected cross-site scripting (XSS). An attacker can craft a malicious URL or input that, when processed by the affected Reebox versions (<1.4.8), results in script execution in the victim's browser. The vulnerability requires user interaction (UI:R) and can impact confidentiality, integrity, and availability to a limited extent (C:L/I:L/A:L). It is remotely exploitable over the network without privileges (AV:N/PR:N).

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability at a limited level. No known active exploitation has been reported.

No official patch or vendor advisory is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted input and URLs. Implementing web application firewall (WAF) rules to detect and block reflected XSS attempts may help mitigate risk temporarily.