This vulnerability (CVE-2025-11962) involves improper neutralization of input during web page generation in the Digital Corporate Warehouse product by DivvyDrive Information Technologies Inc., leading to stored Cross-site Scripting (CWE-79). It affects versions prior to 4.8.2.22. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with high impact on confidentiality and integrity but no impact on availability.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to disclosure or modification of sensitive information. The impact is rated high due to the potential compromise of confidentiality and integrity. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor DivvyDrive Information Technologies Inc. advisories for updates. In the meantime, limit exposure by restricting access to trusted users and exercising caution with user-generated content. Avoid relying on generic mitigations unless specifically recommended by the vendor.