This vulnerability involves a cross-site scripting flaw in BichitroGan ISP Billing Software 2025.3.20, located in the Customer Handler component's edit customer route. The flaw permits remote attackers to inject malicious scripts, potentially leading to client-side code execution when a user accesses the affected functionality. The vendor has not issued a fix or advisory, and no patch links are available. Exploit code is publicly available, but no known exploitation in the wild has been reported. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on integrity.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side impacts. However, the impact is limited by the requirement for user interaction and the low integrity impact. No evidence of active exploitation has been reported.

No official patch or remediation is currently available from the vendor, who has not responded to disclosure attempts. Users should monitor vendor communications for updates. Until a fix is released, consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting the affected endpoint. Avoid exposing the vulnerable functionality to untrusted users if possible.