EUVD-2025-209275

This vulnerability stems from improper input validation and output encoding in the account-group management feature of yaffa, a web application. The root cause is classified under CWE-94 (Code Injection), indicating that user-supplied input is processed without adequate sanitization before being rendered in the HTML context. The attack vector is network-based with low complexity, requiring only that an attacker craft a malicious account group name containing JavaScript payload; the application then stores and reflects this payload to subsequent users viewing the account group listing. No specific authentication is required to exploit the vulnerability (PR:N per CVSS vector), though successful exploitation depends on UI interaction from a victim user.