CVE-2024-37776 is a cross-site scripting (XSS) vulnerability affecting Sunbird DCIM dcTrack version 9.1.2. The flaw allows attackers with high privileges to inject and execute arbitrary web scripts or HTML through crafted payloads in some administrative interface screens. The vulnerability has a CVSS 3.1 base score of 4.8, reflecting a medium severity level. It requires network access, low attack complexity, high privileges, and user interaction, and it impacts confidentiality and integrity with no impact on availability. No known exploits in the wild or patches are currently documented.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected application, potentially allowing attackers to compromise confidentiality and integrity of data accessible via the administrative interface. However, exploitation requires high privileges and user interaction, limiting the scope and ease of attack. There is no impact on system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and avoid interacting with untrusted content in admin screens. Monitor vendor channels for updates regarding patches or mitigations.