This vulnerability is a stored XSS issue (CWE-79) in Vinna Process Monitor version 3.1.2, where insufficient input neutralization during web page generation enables an authenticated attacker with low privileges to inject malicious JavaScript. The injected script can be used to steal administrative session tokens and credentials, potentially escalating privileges or compromising administrative accounts. The CVSS 3.1 base score is 8.7, reflecting network attack vector, low attack complexity, required privileges, user interaction, and high impact on confidentiality and integrity. No vendor advisory or patch information is available, and the product is not a cloud service.

An attacker with low privileges who is authenticated can exploit this vulnerability to inject malicious scripts that steal administrative access tokens and session credentials. This compromises the confidentiality and integrity of administrative accounts, potentially allowing unauthorized administrative access. There is no indication of impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for suspicious activity. Consider applying web application firewall (WAF) rules to detect and block XSS payloads if possible. Avoid granting unnecessary privileges to users to reduce risk.