CVE-2026-28158 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting Do Lasso software versions up to 358. The vulnerability allows attackers to execute arbitrary scripts in the context of users without requiring authentication. The CVSS 3.1 vector indicates the attack can be performed remotely with low complexity, no privileges required, and requires user interaction. The impact includes partial loss of confidentiality, integrity, and availability.

Successful exploitation can lead to execution of arbitrary scripts in users' browsers, potentially resulting in theft of sensitive information, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability to a limited extent. The vulnerability does not require authentication, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, consider applying web application firewall rules or input validation controls to mitigate exploitation risks.