The vulnerability CVE-2026-82969 in eBA Plus Document and Workflow Management System is due to improper input neutralization during web page generation, leading to stored cross-site scripting (CWE-79). This allows an attacker with at least low privileges to inject malicious scripts that can be executed in the context of other users. The affected versions are from 6.7.141 before 10.0.11. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impact without availability impact.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of users viewing the affected web pages, potentially leading to information disclosure or manipulation of user sessions. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires low privileges and no user interaction to exploit.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting access to trusted users and monitoring for suspicious activity related to script injection.