This vulnerability (CVE-2024-34429) is a stored cross-site scripting (CWE-79) issue in the Orchestrated Corona Virus (COVID-19) Banner & Live Data software up to version 1.8.0.2. It results from improper neutralization of input during web page generation, enabling attackers with high privileges to inject malicious scripts that execute when viewed by other users. The CVSS 3.1 base score is 5.9 (medium), with attack vector network, low attack complexity, required privileges high, user interaction required, and impacts on confidentiality, integrity, and availability rated low to low. No official fix or patch is currently documented, and no known exploits have been reported.

Successful exploitation could allow an attacker with high privileges to inject and store malicious scripts that execute in the context of other users viewing the affected web pages. This can lead to limited confidentiality, integrity, and availability impacts such as session hijacking, unauthorized actions, or information disclosure. However, exploitation requires user interaction and high privileges, reducing the overall risk. No known active exploitation has been reported.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict high-privilege access to the affected application and validate or sanitize inputs where possible to reduce risk. Monitor vendor communications for updates on remediation.