This vulnerability affects Fengoffice Feng Office up to version 3.11.13.11 in the getTitle function of the add_task.php view file. By manipulating the og_objects.name parameter, an attacker can inject malicious scripts leading to cross-site scripting (XSS). The attack can be performed remotely and requires low attack complexity with low privileges and user interaction. The vulnerability has been publicly disclosed, but no vendor response or patch is available.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or redirection to malicious sites. The attack requires user interaction and low privileges but can be launched remotely. The medium severity score reflects moderate impact and exploitability.

No official fix or patch has been provided by the vendor. Since the vendor did not respond and no patch links are available, users should consider implementing input validation and output encoding as temporary mitigations to prevent script injection in the affected parameter. Monitor official channels for any future updates or patches.