Enocta Platform EUVD-2026-88240

Exploitation requires (1) an authenticated account on the Enocta Platform with the ability to submit input that is rendered into an HTML attribute context (PR:L per the CVSS vector), and (2) a victim user who subsequently views/renders the attacker-controlled content (UI:R). The specific injection sink is an HTML attribute ('XSS Targeting HTML Attributes'), meaning the attacker must break out of the attribute's quoting/context rather than a raw HTML body. Limiting factors: no unauthenticated path (an account is needed), no automatic exploitation without a victim rendering the content, and impact is confined to integrity in the victim's browser session (no direct data-store confidentiality or availability impact). All versions through 2026-09-28 are affected.

This is a genuinely low-to-moderate risk issue, not a high-severity emergency. The CVSS 3.1 base score is 4.1 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N - network-reachable and low-complexity, but gated by two meaningful brakes: the attacker must already be authenticated (PR:L) and a victim must interact/render the malicious content (UI:R). Impact is limited to integrity (I:L) via script execution in the victim's browser context; there is no direct confidentiality (C:N) or availability (A:N) impact in the base metrics, though the S:C scope-change reflects that the injected script executes outside the vulnerable component's authorization boundary (the victim's session). No EPSS score, no CISA KEV listing, and no public POC are provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. There are no conflicting signals - description (attribute-context XSS), CWE-79, and the CVSS vector are mutually consistent. The realistic ceiling for stored/attribute XSS in an LMS is session hijacking or acting as another user (potentially an instructor/admin who views attacker-supplied content), which raises real-world concern above the raw score, but the authentication + user-interaction requirements keep this off the top-priority tier.

An authenticated low-privilege Enocta user (e.g., a learner or content author) submits input that is reflected/stored into an HTML attribute without proper neutralization, breaking out of the attribute to inject script. When another user - potentially an instructor or administrator - views that content, the script runs in their authenticated session, enabling session/cookie theft or actions on their behalf. No public exploit code is identified at time of analysis, so an attacker would need to craft the attribute-breakout payload themselves.