This vulnerability (CVE-2024-4754) in Next4Biz CRM & BPM Software's BPM module is a stored cross-site scripting (CWE-79) issue caused by improper input sanitization during web page generation. It affects version 6.6.4.4 and earlier versions before 6.6.4.5. The flaw allows attackers with limited privileges and requiring user interaction to inject malicious scripts that can execute in the context of other users' browsers, potentially leading to information disclosure or session manipulation. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, and user interaction, with partial impact on confidentiality and integrity but no impact on availability. No vendor advisory or patch is currently available, and no exploits are known in the wild.

Successful exploitation could allow an attacker with limited privileges to inject and store malicious scripts that execute in other users' browsers when they view affected pages. This can lead to partial confidentiality and integrity impacts, such as theft of sensitive information or manipulation of user sessions. There is no impact on system availability. The vulnerability requires user interaction and privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply strict input validation and output encoding where possible, and limit user privileges to reduce risk. Monitor vendor communications for updates on patches or official mitigations.