This vulnerability involves a cross-site scripting (XSS) flaw in BichitroGan ISP Billing Software 2025.3.20, specifically in the Pool List Interface accessed via the /?_route=pool/add endpoint. The flaw allows remote attackers to inject and execute malicious scripts by manipulating input parameters. The vendor was notified but has not provided any response or patch. The CVSS 4.8 score reflects an attack vector that is network accessible with low complexity but requires some privileges and user interaction. No official remediation or patch is currently known.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side impacts. However, the vulnerability requires some level of privilege and user interaction, which limits the scope of impact. No known active exploitation has been reported.

No official patch or remediation is currently available from the vendor. Users should apply general XSS mitigations such as input validation and output encoding where possible. Monitor vendor channels for any future updates or patches. Since the vendor has not responded, consider implementing web application firewalls or other protective controls to detect and block malicious input targeting the vulnerable endpoint.