This vulnerability (CVE-2026-2342) involves improper input neutralization in ValeApp by OceanicSoft Informatics Systems Ltd., leading to stored cross-site scripting (CWE-79). An attacker can inject malicious scripts that persist on the server and execute in the context of users' browsers when they access affected pages. The CVSS 3.1 base score is 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity. The vendor was contacted but did not respond, and no patch or official remediation is currently available. The affected versions are not explicitly enumerated beyond being up to 09072026.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of affected users, potentially leading to theft of sensitive information, session hijacking, or unauthorized actions performed on behalf of the user. The vulnerability does not impact availability. The critical CVSS score reflects the high confidentiality and integrity impact with remote exploitation possible without privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should apply standard XSS mitigations such as input validation and output encoding where possible, and consider restricting user input or disabling vulnerable features until a fix is released.