CVE-2024-29908 is a CWE-79 stored cross-site scripting vulnerability in Kienso's Co-marquage service-public.fr product, affecting versions through 0.5.71. The issue stems from improper input neutralization during web page generation, enabling attackers to inject and store malicious scripts that execute in the context of other users' browsers. The vulnerability has a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), indicating network attack vector, low attack complexity, requiring low privileges and user interaction, with a scope change and limited impact on confidentiality, integrity, and availability. No patches or official remediation guidance are currently available, and no known exploitation has been reported.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to limited disclosure of information, modification of data, or disruption of service. The impact is rated medium based on the CVSS score and the described effects on confidentiality, integrity, and availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider implementing additional input validation or output encoding as a temporary mitigation. Monitor vendor channels for updates regarding patches or official mitigations.