A Cross-Site Scripting (XSS) vulnerability exists in the /zabbix.php?action=export.valuemaps endpoint due to improper handling of the backurl parameter. This allows injection and execution of arbitrary JavaScript in the victim's browser context. The vulnerability has a medium severity rating with a CVSS score of 5.4.