A cross-site scripting (XSS) vulnerability exists in Zucchetti Ad Hoc Infinity version 4.2 and earlier. This flaw allows remote unauthenticated attackers to inject arbitrary JavaScript code via the pHtmlSource parameter in the /ahi/jsp/gsfr_feditorHTML.jsp endpoint. The vulnerability has a CVSS score of 6.1, indicating a medium severity impact.