CVE-2026-15552 describes a stored cross-site scripting vulnerability in Ragic's Enterprise Cloud Database. The flaw arises from improper neutralization of input during web page generation, enabling unauthenticated attackers to inject persistent JavaScript code. This code executes in the context of users' browsers upon page load, potentially leading to unauthorized actions or data exposure. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. No remediation level or patch information is currently available, and no affected versions are specified. The vulnerability is published and assigned by TW-CERT.

Successful exploitation allows unauthenticated remote attackers to inject persistent JavaScript that executes in users' browsers. This can lead to unauthorized actions performed with the user's privileges or exposure of sensitive information accessible in the browser context. The impact is limited to the scope of the affected web application and user sessions. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor for vendor updates. Until a patch is available, consider applying any recommended input validation or output encoding workarounds if provided by the vendor. Avoid exposing sensitive data in affected pages and limit user privileges where possible.