URVE Smart Office contains a stored cross-site scripting (XSS) vulnerability in its report problem functionality. An attacker with a low-privileged account can upload a malicious SVG file that executes code when accessed by any user, as the resource is publicly accessible without authentication. This vulnerability was fixed in version 1.1.24.