EUVD-2025-210739
GHSA-2482-vx42-rm68
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Stored XSS fires in a victim's browser (UI:R); payload crosses to another user's session context (S:C); PR:H retained as high privilege is required to plant the payload.
Primary rating from Vendor (Mandiant).
CVSS VectorVendor: Mandiant
Lifecycle Timeline
2DescriptionCVE.org
Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via persistent cross-site scripting
AnalysisAI
Persistent cross-site scripting in Otalio Ship Property Management System (all versions before 2.22.0) enables authenticated high-privileged attackers to escalate privileges by injecting unescaped malicious scripts into the application security page. The stored payload executes in the browser context of other authenticated users who subsequently view the affected page, enabling session hijacking or unauthorized actions under victim credentials. Reported by Mandiant; no public exploit code or CISA KEV listing identified at time of analysis.
Technical ContextAI
The vulnerability is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) manifesting as stored XSS. The application security page in Otalio's Ship Property Management System fails to sanitize or escape values before persisting them to storage and subsequently rendering them in HTML context, allowing injected script to be served to any user loading the page. The affected product is identified by CPE cpe:2.3:a:otalio:ship_property_management_system:*:*:*:*:*:*:*:*, covering all releases prior to 2.22.0. Ship PMS software manages vessel assets, certificates, maintenance, and crew data - its security configuration pages are typically accessible to operations and fleet administrators, meaning victim users who render the poisoned page likely hold meaningful privileges themselves, amplifying the privilege-escalation impact described in the advisory.
RemediationAI
Upgrade to Otalio Ship Property Management System version 2.22.0 or later, which resolves the unescaped output rendering in the application security page. The vendor advisory is available via https://www.otalio.com/solutions/ and the Mandiant disclosure is documented at https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0024.md. If immediate patching is not feasible, restrict access to the application security page to the minimum required administrative accounts, reducing the population of potential victims who could trigger the stored payload. Additionally, enforce Content Security Policy headers at the web server or reverse-proxy layer to block inline script execution, which would mitigate XSS payload impact at the cost of potential compatibility issues with legitimate inline scripts in the application. Monitor application security page access logs for unexpected modifications by lower-privileged accounts as a detection compensating control.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today