Description
A cross-site scripting (XSS) vulnerability exists in FlexCMS through the PreviousColorsString parameter. The parameter value is reflected in the page output without proper HTML encoding.
Impact
An attacker can craft a malicious link that, when visited by a user, executes arbitrary JavaScript in their browser context. This enables cookie theft, session hijacking, and unauthorized actions on behalf of the victim.
Solution
Apply HTML output encoding to the PreviousColorsString parameter. Contact the vendor for a patched version.