This vulnerability involves improper neutralization of input in the iamroody 金数据 jinshuju application, leading to stored cross-site scripting (XSS). An attacker can inject malicious scripts that are stored and later executed in the context of other users' browsers. The affected versions include all versions up to 1.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with a scope change and partial impacts on confidentiality, integrity, and availability. No patch or vendor advisory information is currently available.

Successful exploitation of this stored XSS vulnerability can allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to partial disclosure of information, modification of data, and disruption of availability. The CVSS score of 6.5 reflects a medium severity impact, with partial compromise of confidentiality, integrity, and availability. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with input handling and consider implementing web application firewalls or input sanitization as temporary mitigations. Monitor vendor communications for updates on patches or official fixes.