This vulnerability involves a reflected XSS in Lightcms v2.0's /admin/menus component, where the referer HTTP header value is not properly sanitized before being reflected in the response. An attacker can craft a request with a malicious referer header to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking or other client-side impacts. The CVSS vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality and integrity but not availability.

Successful exploitation allows execution of arbitrary JavaScript in the context of the victim's browser, potentially leading to theft of sensitive information or session tokens. The impact is limited to confidentiality and integrity, with no direct impact on system availability. No known exploits have been reported, so active exploitation is not confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when accessing the /admin/menus component and avoid clicking on suspicious links that could trigger the vulnerability. Implementing web application firewall (WAF) rules to detect and block malicious referer headers may provide temporary mitigation.