This vulnerability in Stagtools allows an attacker with at least low privileges and requiring user interaction to inject and store malicious scripts via improperly sanitized input during web page generation. When other users access the affected pages, the stored scripts may execute, potentially leading to partial compromise of confidentiality, integrity, and availability. The issue affects all versions through 2.3.8. No vendor advisory or patch information is provided, and the product is not a cloud service.

Successful exploitation can lead to execution of arbitrary scripts in the context of users viewing the affected web pages, potentially resulting in partial loss of confidentiality, integrity, and availability of the affected system or user data. The CVSS vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with scope changed and low impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor channels for updates or patches addressing this vulnerability.