CVE-2026-28004 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting Business Directory software versions up to 6.4.25. The vulnerability allows remote attackers to inject malicious scripts that execute in the context of the victim's browser. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed, with impacts on confidentiality, integrity, and availability rated as low to low and low respectively.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially allowing theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability at a low level. The vulnerability does not require authentication, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, consider applying input validation and output encoding mitigations where possible to reduce XSS risks.