A reflected cross-site scripting vulnerability in AIL Framework permits authenticated attackers to inject malicious scripts, potentially leading to session theft or unauthorized actions.

The application contains a reflected cross-site scripting flaw within the /tag/add_tags endpoint (CWE-79). This requires the attacker to be authenticated with low privileges and requires user interaction to execute the malicious payload.

With a CVSS score of 8.2, this vulnerability poses a high risk to user accounts and session integrity. An attacker could potentially steal session cookies or perform unauthorized actions on behalf of a legitimate user, leading to potential data compromise or administrative control within the framework.

Immediate Action: Update the AIL Framework to the latest available version provided by the vendor to resolve the input sanitization issue.

Proactive Monitoring: Review web access logs for suspicious input parameters within the /tag/add_tags endpoint that contain script tags or encoded characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS attack patterns targeting application parameters.

Public Exploit Available: No confirmed public exploit in the available data.

Security teams should ensure that all instances of AIL Framework are updated to the latest version immediately. Furthermore, users should be trained to exercise caution when interacting with untrusted links that may trigger reflected scripts within the application.