The th30d4y IP Reputation Checker application versions from 1.0.1 to before 2.0.1 contain a DOM-Based Cross-Site Scripting vulnerability (CWE-79) where user input is not properly sanitized before being rendered in the browser. This allows an attacker to inject and execute arbitrary JavaScript code in the context of the victim's browser. The vulnerability has been fixed in version 2.0.1. The CVSS 3.1 base score is 6.1, reflecting a medium severity with network attack vector, low complexity, no privileges required, user interaction needed, and partial impact on confidentiality and integrity but no impact on availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript in the context of the affected application, potentially leading to information disclosure or manipulation of client-side data. However, the impact is limited to confidentiality and integrity with no availability impact. There are no known active exploits in the wild.

Upgrade the th30d4y IP Reputation Checker application to version 2.0.1 or later, where this vulnerability has been patched. No other specific mitigations are indicated. Patch status is confirmed by the vendor's versioning information in the advisory.