This vulnerability is a stored XSS issue (CWE-79) affecting Sangoma Switchvox SMB Edition 8.3 (104997). The flaw exists because the voicemail notification template endpoint (submit_modify_voicemail_template) fails to neutralize HTML input properly. Authenticated users can inject malicious JavaScript through the template_text parameter, which is then stored server-side and rendered to other users, potentially leading to script execution in their browsers. The CVSS 4.0 score is 7.0, indicating high severity with network attack vector, low attack complexity, and partial user interaction required. No vendor advisory or patch information is available, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated user to inject and store malicious JavaScript code that executes in the context of other users' browsers when they view the affected voicemail notification templates. This can lead to session hijacking, unauthorized actions, or data theft within the affected application context. The vulnerability requires authentication and some user interaction but has a low attack complexity and network vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the voicemail notification template functionality to trusted users only and consider applying input validation or output encoding controls where possible to mitigate stored XSS risks.