CVE-2026-108495: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Brainstorm Force SureForms

This vulnerability in Brainstorm Force SureForms (versions >=0 and <2.12.8) is due to improper neutralization of input during web page generation, leading to stored cross-site scripting (XSS). An attacker could inject malicious scripts that are stored by the application and later executed in the context of users' browsers, potentially leading to information disclosure, session hijacking, or other impacts. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with a scope change and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure, session hijacking, or other malicious actions. The impact is rated as medium severity with partial confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Brainstorm Force advisories for updates and apply patches once available.