This vulnerability (CVE-2024-12796) involves improper neutralization of input during web page generation in Workcube ERP versions 12 to 14 before Cognitive, leading to reflected Cross-site Scripting (CWE-79). An attacker could exploit this to inject malicious scripts into web pages viewed by other users. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality with no impact on integrity or availability. No official patch or remediation guidance is currently available from the vendor, and no exploits are known in the wild.

Successful exploitation could allow an attacker to execute malicious scripts in the context of the affected web application, potentially leading to information disclosure affecting confidentiality. There is no reported impact on integrity or availability. The vulnerability is limited to Workcube ERP versions 12 through 14 before Cognitive and does not affect cloud-hosted services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding workarounds if feasible. Monitor vendor communications for updates on patches or official mitigations. No known exploits in the wild reduce immediate urgency, but caution is advised.