This vulnerability (CWE-79) in the Enocta Platform allows an attacker to inject malicious scripts by failing to properly neutralize input during the generation of web pages, particularly within HTML attributes. This can lead to cross-site scripting attacks that may affect the integrity of the web application session or user interaction. The affected versions are all versions up to and including 2026-09-28.

The vulnerability allows for limited integrity impact through cross-site scripting attacks, which could enable attackers to execute scripts in the context of the affected application. There is no confidentiality or availability impact reported. The attack complexity is low, but requires low privileges and user interaction. The scope is changed, indicating the vulnerability affects components beyond the vulnerable code itself.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible.