This vulnerability involves a cross-site scripting issue in BichitroGan ISP Billing Software 2025.3.20, specifically in the Profile Page Handler component accessed via the /?_route=settings/users-view/ URL. An attacker can remotely manipulate input to trigger XSS, potentially leading to script execution in the context of the affected application. The CVSS 4.0 base score is 4.8, indicating medium severity with network attack vector, low attack complexity, and requiring user interaction and high privileges. No vendor response or patch is currently available.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected user's browser session within the ISP Billing Software. This may lead to session hijacking, defacement, or other client-side impacts. However, the attack requires high privileges and user interaction, limiting the scope and ease of exploitation. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider restricting access to the affected component and applying web application firewall (WAF) rules to detect and block XSS payloads targeting the /?_route=settings/users-view/ endpoint. Monitor for any vendor updates or official fixes.