ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored Cross-Site Scripting (XSS). This vulnerability allows a low privileged attacker to inject arbitrary HTML and JavaScript into notes, which execute when viewed by users. The issue has been fixed in PROTECTELMAJ version 6.5.19 and BDF version 6.4.67.