This vulnerability involves insufficient sanitization of user-supplied input in the profile management component of T-Systems TAO 2.0. Authenticated users can inject malicious scripts into their personal data fields, which are stored and later rendered in other users' browsers without proper escaping or filtering. This stored XSS can lead to execution of arbitrary JavaScript code in the context of the victim's session, potentially compromising session data or enabling unauthorized actions. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond authentication, and user interaction required. The vulnerability is classified under CWE-613 (Insufficient Session Expiration), though the description focuses on stored XSS.

Successful exploitation allows execution of arbitrary JavaScript in the context of another user's session when viewing the affected profile. This can lead to theft of session information or unauthorized actions performed with the victim's permissions. The impact is limited to authenticated users viewing the malicious profile data. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the victim's existing permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict profile data input to trusted users and consider additional input sanitization or output encoding on the application side to mitigate stored XSS risks.