CVE-2024-29115 is a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability affecting Zaytech Smart Online Order for Clover up to version 1.5.5. It allows stored cross-site scripting (XSS) attacks, where malicious input is not properly sanitized before being included in web pages, enabling attackers to execute arbitrary scripts in the context of other users. The vulnerability has a CVSS 3.1 score of 6.5, reflecting medium severity with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacts confidentiality, integrity, and availability to a limited extent. No official fix or patch has been published yet, and no known exploits have been observed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the browsers of users interacting with the affected application, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The impact is rated medium severity based on the CVSS score of 6.5. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should follow vendor communications closely. Until a patch is released, consider applying any recommended temporary mitigations from the vendor or restricting user input that could be stored and rendered. Avoid relying on generic mitigations unless specifically advised by the vendor.