A cross-site scripting (XSS) vulnerability exists in Zucchetti Ad Hoc Revolution version 4.1 and earlier. This flaw allows remote unauthenticated attackers to inject arbitrary JavaScript code via the pHtmlSource parameter in the /ahrw/jsp/gsfr_feditorHTML.jsp endpoint. The vulnerability has a medium severity rating with a CVSS score of 6.1. No known exploits are reported in the wild, and no patch or remediation information is currently available.