This vulnerability in Xiaopi Panel 1.0.0 involves improper input handling in the /demo.php file within the WAF Firewall component. Specifically, the 'param' argument can be manipulated to inject malicious scripts, resulting in a cross-site scripting condition. The vulnerability allows remote attackers to execute scripts in the context of the affected application, potentially leading to session hijacking or other client-side impacts. The CVSS 4.0 base score is 5.1, indicating medium severity, with network attack vector, low attack complexity, and partial impact on integrity and availability. The vendor has not provided a fix or advisory, and no cloud service is involved.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected Xiaopi Panel application, potentially leading to theft of user credentials, session tokens, or other sensitive information accessible via the browser. The impact is limited to the client side and does not directly affect server confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing web application firewall rules or input validation workarounds to mitigate XSS risks. Monitoring for updates from the vendor or trusted security sources is recommended.