This vulnerability (CVE-2026-8166) involves improper neutralization of input in the e-Logo Purchasing Portal by Logo Software Industry and Trade Inc., leading to stored cross-site scripting (XSS). An attacker could inject malicious scripts that are stored and later executed in the context of users' browsers. The issue affects versions prior to 1.52 of the e-Logo Purchasing Portal. The CVSS vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with a scope change and limited confidentiality and integrity impact, but no availability impact.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to limited confidentiality and integrity impacts such as theft of user data or session tokens. There is no impact on availability. The vulnerability requires low privileges and user interaction but can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a patch is available, users should exercise caution with untrusted input and consider applying any vendor-recommended mitigations once published.