WidzialniCMS has a reflected cross-site scripting (XSS) vulnerability in its /index.php endpoint. This flaw allows an attacker to craft a malicious URL that executes arbitrary JavaScript in the victim's browser, potentially leading to session cookie theft. The vulnerability has been fixed in version 2.5.