This vulnerability involves reflected XSS in diskover-community <= 2.3.5, specifically in the public/selectindices.php file through the namecontains parameter. An attacker could potentially inject malicious scripts that are reflected back to users, leading to client-side code execution. However, no further technical details, CVSS score, or vendor advisories are available to clarify the extent or remediation status of this issue.

The impact is limited to reflected cross-site scripting, which can allow attackers to execute arbitrary scripts in the context of a user's browser session when they interact with the vulnerable parameter. This could lead to session hijacking, defacement, or other client-side attacks. No known exploits in the wild have been reported, and no official impact assessment from the vendor is available.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider applying input validation or output encoding on the namecontains parameter as a temporary mitigation. Monitor vendor channels for updates regarding an official fix.