This vulnerability (CVE-2026-3251) involves improper input neutralization in the Mezunum Satiyorum web application, leading to stored cross-site scripting (CWE-79). An attacker can inject malicious scripts that are stored and later executed in the context of other users' browsers. The affected version explicitly identified is 1.2.504. The vulnerability has a CVSS 3.1 score of 6.4 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, requiring low privileges, no user interaction, scope changed, with low confidentiality and integrity impact and no availability impact. The vendor has not provided any response or patch, and no known exploits are reported in the wild.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to data disclosure or modification within the scope of the vulnerable application. This can compromise user confidentiality and integrity but does not affect availability. The scope change in CVSS indicates that the vulnerability can affect components beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider applying web application firewalls or input validation controls as temporary mitigations. Monitor official channels for updates or patches from the vendor.