CVE-2026-65565 is an unauthenticated cross-site scripting (XSS) vulnerability classified under CWE-79 in Ays Pro Survey Maker software versions up to 5.2.3.3. The flaw arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that execute in the context of the victim's browser. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. The vulnerability is published but lacks an official remediation or patch at this time. The product is not a cloud service, so remediation depends on vendor updates to the software.

Successful exploitation of this vulnerability can lead to the execution of arbitrary scripts in the context of the affected web application, potentially allowing attackers to steal sensitive information, manipulate data, or disrupt service availability. Since the vulnerability is unauthenticated, attackers do not need valid credentials to exploit it. The impact affects confidentiality, integrity, and availability as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying any available workarounds recommended by the vendor or restrict access to the affected application to trusted users only. Monitor vendor communications for updates on patches or mitigations.