Alinto SOGo versions prior to 5.12.5 contain an XSS vulnerability (CWE-79) in the handling of events, tasks, and contacts categories. This improper input neutralization allows an attacker with low privileges and network access to inject malicious scripts, potentially leading to partial confidentiality and integrity impacts. The vulnerability does not affect availability and does not require user interaction. The CVSS score of 6.4 reflects these characteristics. No patch or vendor advisory details are currently available to confirm remediation status.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to limited confidentiality and integrity impacts. The vulnerability does not impact system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and applying any recommended workarounds from the vendor once published. Monitor official Alinto communications for updates on patches or mitigations.