This vulnerability (CVE-2026-87752) in Agentis software by Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. is an improper neutralization of input during web page generation, classified as CWE-79 (Cross-site scripting). It allows an attacker to inject malicious scripts targeting HTML attributes, potentially leading to partial confidentiality and integrity impacts. The affected versions are >=4.44 and <4.6. The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, with low confidentiality and integrity impacts and no availability impact.

Successful exploitation could allow an attacker to execute malicious scripts in the context of the affected web application, potentially leading to partial disclosure of information and modification of data within the user's session. There is no indication of availability impact. The vulnerability requires user interaction and does not require privileges, but the scope is changed, meaning the impact extends beyond the vulnerable component.

No explicit patch or remediation details are provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted input and consider applying any vendor-provided mitigations once announced.