This vulnerability in HurryTimer involves improper sanitization of user input during web page generation, leading to stored cross-site scripting (XSS). An attacker could inject malicious scripts that persist on the server and execute when other users access the affected pages. The issue affects HurryTimer versions up to 2.14.2. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and impacts confidentiality, integrity, and availability at a low level.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of other users, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability. The CVSS score of 5.9 reflects a medium impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor official channels for updates from the vendor regarding fixes or workarounds.