Garage 24 EUVD-2026-110034

Exploitation requires an authenticated account on the Garage 24 Garage Management Software application (CVSS PR:L) with the ability to reach the /edit_profile endpoint of the Profile component and supply attacker-controlled values for the first_name or last_name arguments. Successful impact further requires user interaction (UI:P): a victim must load the page that renders the injected profile data for the script to execute. Limiting factors are therefore the authentication requirement and the dependency on a victim viewing the malicious profile; there is no confidentiality or availability impact per the rated vector, and no fixed version is available from the vendor, so mitigation currently depends on input/output sanitization controls rather than a vendor patch.

This is a low-to-moderate priority issue that does not warrant emergency handling. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) describes a network-reachable but privilege-and-interaction-gated flaw: the attacker needs at least low-level authentication (PR:L) and a victim must perform an action (UI:P), and the only rated impact is low integrity (VI:L) with no confidentiality or availability impact. This is consistent with a CWE-79 cross-site scripting bug confined to profile display fields. The exploitation signals are weak-to-moderate: a public PoC reference exists but is not verified as working exploit code, there is no CISA KEV listing (not actively exploited per available data), and no EPSS score was provided in the input, so widespread-exploitation probability cannot be quantified. The vuln.today decision label is 'this_month', indicating routine scheduled remediation rather than act_now/emergency. A notable complication is remediation: the input states the vendor was contacted early but did not respond, so no patch or fixed version is available, which raises the practical risk relative to the modest technical severity because defenders cannot simply apply a vendor fix. No signals conflict with each other here; the overall picture is a genuine-but-low-severity XSS in a niche product with no confirmed active exploitation.

An authenticated low-privilege user of the Garage 24 application edits their profile and injects a malicious script into the first_name or last_name field via the /edit_profile endpoint. When another user or an administrator subsequently views that profile data in their browser, the stored script executes in their session context, potentially performing actions as that victim. A public PoC reference exists but is not verified as working exploit code.