This vulnerability in Thomas Harris Search Cloud One (<= 2.2.5) involves improper neutralization of input during web page generation, resulting in stored cross-site scripting (XSS). An attacker with high privileges can inject malicious scripts that execute when other users view the affected pages. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) reflects network attack vector, low attack complexity, required high privileges, required user interaction, scope change, and limited impact on confidentiality, integrity, and availability. The vulnerability was published on 2025-09-05, with no patch or exploit information currently provided.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected application, potentially allowing attackers to steal sensitive information, manipulate data, or disrupt service. The impact is limited by the requirement for high privileges and user interaction. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to high-privilege users and limit exposure of vulnerable functionality. Monitor vendor communications for updates on patches or mitigations.