This vulnerability is a reflected XSS in diskover-community <= 2.3.5, specifically in the public/view.php file through the doctype parameter. Reflected XSS occurs when user-supplied input is immediately returned by the web application without proper sanitization or encoding, enabling script injection. The vulnerability is publicly disclosed but lacks a CVSS score and vendor remediation details. No exploits are currently known in the wild.

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, defacement, or redirection to malicious sites. However, no active exploitation has been reported, and the impact depends on the victim interacting with a maliciously crafted URL.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding on the doctype parameter if possible, or restrict access to the vulnerable endpoint. Monitor vendor channels for updates regarding patches or official mitigations.