The CVSS 6.1 rating assigned to this F-RevoCRM cross-site scripting vulnerability almost certainly understates the real risk, and the clue is hiding in plain sight: the advisory states the XSS can perform 'unintended operations,' but never specifies what those operations are. That ambiguity is the signal, not just a communication failure.
In a CRM system handling contact records, deal pipelines, and client-facing business processes, an XSS payload is not passively stealing session cookies—it is executing inside an application where user actions are authoritative. The operations this XSS can trigger could range from modifying contact records to altering audit logs, escalating privileges within the CRM's role hierarchy, or exfiltrating customer data through the system's integration points. You cannot determine severity without answering that question, and the advisory does not answer it.
What makes this worse: F-RevoCRM is a Japanese CRM, meaning data processed through it likely falls under Japan's APPI (Act on Protection of Personal Information). If this XSS can modify audit-logged fields—a real possibility the advisory won't confirm or deny—you're not looking at just a confidentiality issue. You're looking at a data integrity problem where the vulnerability can erase its own forensic fingerprints, potentially converting a technical XSS into a breach notification trigger under Japanese regulatory obligations.
The EPSS score of 0.00262 reflects low automated exploitation probability, which is consistent with targeted CRM attacks that require authentication and social engineering rather than mass scanning. This changes the threat model entirely. The attackers who will exploit this are not running opportunistic Nmap scans—they're precision operators who have already gained access or are actively phishing specific F-RevoCRM users.
Your immediate priorities: determine whether this is stored, reflected, or DOM-based XSS (each changes the exploit chain); map what operations the vulnerable endpoint can trigger against F-RevoCRM's permission model; verify whether audit log fields can be modified through the XSS vector; and treat this as a data integrity issue, not merely a session hijacking risk, until proven otherwise. If you cannot confirm what 'unintended operations' actually means in your F-RevoCRM deployment, treat the finding as higher-severity than the 6.1 rating suggests and accelerate remediation.