AsiaInfo BSS Platform versions before 9.2.38 contain a stored cross-site scripting (XSS) vulnerability in the menu icon upload function. An authenticated user with ordinary privileges can upload an SVG files with embedded JavaScript. The script executes only if a victim loads the SVG directly as a document, such as via direct URL navigation or embedding in an object or iframe element, running under the application origin.