This vulnerability in PixFort pixfort Core (<= 3.2.22) is a reflected cross-site scripting (XSS) flaw caused by improper input neutralization during web page generation. An attacker can craft a malicious URL or input that, when processed by the application, results in script execution in the victim's browser. The CVSS 3.1 score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. The vulnerability is publicly known as of March 2026, but no patch or official remediation guidance is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to theft of user data, session hijacking, or other client-side impacts. The reflected XSS requires the victim to interact with a crafted link or input. The impact is rated high due to the potential compromise of confidentiality, integrity, and availability, but no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and avoid clicking suspicious links related to the affected application. Implementing web application firewall (WAF) rules to detect and block reflected XSS attempts may provide temporary mitigation.