This vulnerability involves a cross-site scripting (XSS) issue in the acmailer CGI product by Extra Innovation Inc. An attacker could exploit this flaw to execute arbitrary scripts, potentially impacting confidentiality and integrity. The CVSS 3.0 vector indicates the attack is network-based, requires no privileges, and user interaction is required. The scope is changed, and the impact is limited to low confidentiality and integrity impacts without availability impact. No remediation level or patch information is provided.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to limited confidentiality and integrity impacts. There is no indication of availability impact or privilege requirements. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is documented, users should monitor vendor communications for updates. Until a patch is available, cautious handling of untrusted input and limiting exposure to the vulnerable CGI may reduce risk.