This vulnerability in ChangeWeDer crm up to commit c07bd4c97141521af6475034bc58523beed51bbd allows remote attackers to perform cross-site scripting by manipulating the customerName argument in the Save Endpoint JavaScript component. The vulnerability is located in src/main/resources/public/js/customerServe/customer.serve.js. The product's rolling release model means no discrete version numbers are provided for affected or fixed releases. The vendor has been informed but has not yet responded or issued a fix. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low attack complexity, and requiring user interaction.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability requires user interaction and low privileges to exploit. There is no indication of direct impact on confidentiality, integrity, or availability beyond the client-side scripting effects.

No official fix or patch is currently available from the vendor. Since the vendor has not responded and no remediation guidance is provided, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor advisories for updates. Avoid exposing the vulnerable endpoint to untrusted users until a fix is released.