October CMS versions prior to 3.7.16 and 4.1.16 contain a reflected XSS vulnerability in the backend DataTable widget. The vulnerability arises from improper neutralization of input during web page generation (CWE-79), specifically due to a query parameter being rendered without proper output escaping. This flaw allows an attacker to inject and execute arbitrary scripts in the context of the affected web application. The CVSS 3.1 base score is 3.1, reflecting low severity with network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact. The issue is resolved in versions 3.7.16 and 4.1.16.

The vulnerability allows reflected XSS attacks which can lead to limited integrity impact by executing malicious scripts in the user's browser. There is no direct impact on confidentiality or availability. The low CVSS score indicates the risk is limited, requiring user interaction and having high attack complexity.

Upgrade affected October CMS installations to version 3.7.16 or 4.1.16 or later, where the vulnerability is fixed. Since the vendor advisory confirms the fix in these versions, applying the official update is the recommended remediation. No additional mitigation steps are indicated.