This vulnerability, identified as CWE-79, involves improper neutralization of input during web page generation in WhatsUp Gold. Authenticated attackers can exploit this flaw to inject persistent malicious scripts by bypassing frontend controls. The CVSS v3.1 score is 8.0, indicating high impact with attack vector requiring adjacent network access, low attack complexity, no privileges required, user interaction required, and resulting in high confidentiality, integrity, and availability impacts. The affected versions are those released before 2026.0.2, though exact affected versions are not explicitly stated. No vendor advisory or patch information is currently available.

Successful exploitation allows an authenticated attacker to inject persistent scripts, potentially leading to full compromise of confidentiality, integrity, and availability of the WhatsUp Gold system. This can result in unauthorized actions, data theft, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit access to trusted users and monitor for suspicious activity related to script injection. Avoid relying solely on frontend controls for input validation.