A vulnerability described as problematic has been identified in BichitroGan ISP Billing Software 2025.3.20. Affected is an unknown function of the file /?_route=pool/add of the component Pool List Interface. Executing a manipulation can lead to cross site scripting.
This vulnerability appears as CVE-2026-6624. The attack may be performed from remote. In addition, an exploit is available.
The vendor was contacted early about this disclosure but did not respond in any way.
