This vulnerability in Basix NEX-Forms (<= 9.1.7) involves improper neutralization of input during web page generation, resulting in stored cross-site scripting (XSS). An attacker can inject malicious scripts that persist in the application and execute when viewed by other users. The CVSS 3.1 score is 7.1 (high), with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes partial loss of confidentiality, integrity, and availability.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to theft of user data, session hijacking, or disruption of service. The CVSS vector indicates partial confidentiality, integrity, and availability impacts. No known exploits are reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with untrusted input and consider temporary mitigations such as input validation or disabling vulnerable features if possible.