The Otalio Ship Property Management System contains a stored cross-site scripting vulnerability (CWE-79) in its application security page. Unescaped stored values allow authenticated attackers to inject malicious scripts that persist and execute in the context of other users, potentially escalating privileges. The vulnerability affects versions prior to 2.22.0. The CVSS 3.1 base score is 6.7, reflecting network attack vector, low attack complexity, high confidentiality and integrity impact, and low availability impact. There is no vendor advisory or patch information currently available.

Successful exploitation allows authenticated attackers to escalate privileges via persistent XSS, compromising confidentiality and integrity of the system with limited impact on availability. This could enable attackers to execute arbitrary scripts in the context of other users, potentially leading to unauthorized actions within the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected application pages to trusted users only and consider additional input validation or output encoding as a temporary mitigation.