This vulnerability is a stored cross-site scripting (CWE-79) issue affecting FairSketch RISE Ultimate Project Manager & CRM version 3.9.4. An attacker with administrator privileges can inject JavaScript code through the file explorer interface when creating new folders. The vulnerability requires user interaction (UI:R) and no privileges (PR:N) beyond administrator access are needed. The attack vector is network-based (AV:N), and the vulnerability impacts confidentiality and integrity with no impact on availability. No known exploits in the wild have been reported, and no patch or remediation has been documented in the provided information.

Successful exploitation allows an attacker with administrator access to inject and store malicious JavaScript code in the application, potentially leading to the compromise of confidentiality and integrity of data accessible through the admin dashboard. The vulnerability does not affect availability. Since it requires administrator privileges, the risk is limited to users with elevated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted personnel only and monitor for suspicious activity related to folder creation in the admin dashboard. Avoid executing untrusted scripts in the admin interface.