CVE-2026-30082 describes multiple stored XSS vulnerabilities in IngEstate Server v11.14.0. The vulnerabilities exist in the Edit feature of the Software Package List page, where user-supplied input in the About application, What's news, or Release note parameters is not properly sanitized, allowing attackers to inject arbitrary web scripts or HTML. This can lead to script execution in the context of the victim's browser session.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to information disclosure or user session compromise. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact with no availability impact.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, users should exercise caution with untrusted input in the affected parameters and consider implementing web application firewall (WAF) rules to detect and block malicious payloads targeting these fields.