This vulnerability (CVE-2024-35752) involves improper input sanitization in the Stellissimo Text Box product by Enea Overclokk, leading to stored cross-site scripting (CWE-79). An attacker with high privileges and requiring user interaction could inject malicious scripts that execute in the context of other users, potentially impacting confidentiality, integrity, and availability to a limited extent. The vulnerability affects versions through 1.1.4. No vendor advisory or patch information is currently provided, and it is not a cloud service.

Successful exploitation could allow an attacker with high privileges to inject and store malicious scripts that execute when other users interact with the affected component. This can lead to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector. However, exploitation requires user interaction and elevated privileges, reducing the overall risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit access to the affected component to trusted users with high privileges and consider applying input validation or output encoding controls where possible to mitigate stored XSS risks.