This vulnerability (CVE-2026-6002) affects DivvyDrive Information Technologies Inc.'s DivvyDrive product versions from 4.8.2.9 before 4.8.3.2. It is caused by improper neutralization of script-related HTML tags in web pages, classified under CWE-80, resulting in a basic Cross-Site Scripting (XSS) flaw. The CVSS 3.1 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. This can enable theft of sensitive information, session hijacking, or disruption of service. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor for vendor updates and consider applying any future patches promptly. Until a patch is available, limiting exposure by restricting access to affected versions or employing web application firewalls with XSS protections may reduce risk.