This vulnerability in elecV2 elecV2P (up to version 3.8.3) allows remote attackers to perform cross-site scripting attacks by manipulating the filename argument in an unknown function of the /logs file within the Endpoint component. The vulnerability requires no privileges and no user authentication but does require user interaction to exploit. The CVSS 4.0 base score is 5.3, indicating medium severity. The vendor has been informed but has not issued any fix or advisory at this time.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side impacts. However, the vulnerability requires user interaction and does not grant direct system access or privilege escalation. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider restricting access to the affected component or implementing web application firewall (WAF) rules to detect and block suspicious input targeting the filename parameter in /logs. Avoid exposing the vulnerable interface to untrusted users where possible.