This vulnerability (CVE-2025-13505) affects Datactive versions from 2.13.34 before 2.14.0.6 and is classified as CWE-79 and CWE-80, indicating improper neutralization of script-related HTML tags during web page generation. The issue allows stored cross-site scripting (XSS), where malicious scripts can be injected and persist in the application, potentially impacting the confidentiality and integrity of data. The CVSS v3.1 base score is 4.8 (medium), with attack vector as adjacent network, low attack complexity, low privileges required, and user interaction needed. The scope is changed, indicating the vulnerability affects resources beyond the initially vulnerable component. No patch or vendor advisory is provided, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the affected application, potentially leading to unauthorized disclosure or modification of data (confidentiality and integrity impacts). Availability is not affected. The attack requires low privileges and user interaction, and the attack vector is adjacent network, limiting the ease of exploitation somewhat. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Datateam Information Technologies Inc. advisories for updates. Until a fix is available, consider applying input validation and output encoding controls where possible to mitigate stored XSS risks in the affected versions. No vendor advisory states that no action is required or that the issue is already mitigated.