A Cross-Site Scripting (XSS) vulnerability exists in GSVoIP web panel version 2.0.90. The vulnerability arises from improper sanitization of the 'msg' parameter in the /painel/gateways.php/error endpoint, allowing injection of arbitrary JavaScript. This can lead to unauthorized script execution in a victim's browser, potentially enabling session hijacking, phishing, or other client-side attacks.