CVE-2024-49696 describes a stored cross-site scripting vulnerability in robosoft Robo Gallery (<= 3.2.21) caused by improper input neutralization during web page generation. This allows attackers with high privileges to inject malicious scripts that are stored and executed in the context of other users, potentially leading to limited confidentiality, integrity, and availability impacts. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting medium severity. There is no vendor advisory or patch information available, and no known exploits have been reported.

Successful exploitation can lead to execution of malicious scripts in users' browsers, potentially allowing attackers to steal sensitive information, manipulate content, or disrupt availability to a limited degree. The CVSS vector indicates that exploitation requires network access, low attack complexity, high privileges, user interaction, and results in limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict high privilege access to the application and apply any available security controls to limit the impact of stored XSS vulnerabilities. Monitor vendor communications for updates regarding patches or official mitigations.