This vulnerability in Events Maker by dFactory allows an attacker with at least low privileges and requiring user interaction to inject and store malicious scripts due to improper input sanitization during web page generation. The vulnerability can lead to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). It affects all versions up to 1.6.14. No official patch or remediation guidance is provided in the available data.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to partial disclosure of information, modification of data, and disruption of service. The impact is limited by the requirement for low privileges and user interaction, and the scope is changed (S:C) meaning the vulnerability can affect resources beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with user-generated content in Events Maker and consider implementing additional input sanitization or content security policies as temporary mitigations.