This vulnerability in gougucms 4.08.18 allows remote attackers to perform cross-site scripting by manipulating the argument value.content in the Record Endpoint component's user record view. The affected file is \gougucms-master\app\admin\view\user\record.html. The vulnerability is exploitable remotely without authentication and has a CVSS 4.0 base score of 5.1, indicating medium severity. The vendor has not issued any fix or advisory, and no patch links are available.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. Since the vulnerability is remotely exploitable without privileges, it poses a risk to users interacting with the vulnerable component. However, the impact is limited to client-side script execution and does not indicate direct server compromise.

No official patch or remediation is currently available from the vendor. Users should monitor for any future vendor advisories or updates. Until a fix is released, consider implementing web application firewall (WAF) rules to detect and block malicious input targeting the value.content parameter. Additionally, review and sanitize user inputs in the affected component if possible.