CVE-2024-37672 is a Cross Site Scripting (CWE-79) vulnerability in Tessi Docubase Document Management product version 5.x. It allows a remote attacker to execute arbitrary code by exploiting improper sanitization of the idactivity parameter. The vulnerability has a CVSS 3.1 score of 5.4 (medium severity) with attack vector network, low complexity, requiring privileges and user interaction. No patch or remediation information is currently available, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker to execute arbitrary code in the context of the affected application, potentially leading to partial compromise of confidentiality and integrity of data. Availability is not impacted. The attack requires some privileges and user interaction, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, limit exposure by restricting access to the affected parameter and applying input validation or sanitization controls where possible.