This vulnerability (CVE-2024-8608) in ValeApp involves improper neutralization of input during web page generation, classified under CWE-79 (Cross-site Scripting). It allows an attacker to inject and store malicious scripts that execute in the context of users' browsers when viewing affected pages. The CVSS 4.0 base score is 7.2, reflecting network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality and availability. The issue affects versions before 2.0.0. No patch or official remediation level has been published yet.

Successful exploitation could allow attackers to execute arbitrary scripts in the context of the victim's browser, potentially leading to data theft, session hijacking, or other malicious actions affecting confidentiality and availability. However, there are no known active exploits reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying input validation or output encoding workarounds if feasible and limit exposure to untrusted input in the application.