E Logo Purchasing Portal
Monthly
Stored XSS in E-Logo Purchasing Portal (all versions before 1.52) by Logo Software Industry and Trade Inc. permits authenticated low-privilege users to inject persistent malicious scripts that execute in the browsers of other portal users. The CVSS scope change (S:C) confirms the payload crosses trust boundaries, enabling session hijacking, credential theft, or unauthorized actions against procurement administrators and reviewers who visit affected pages. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored XSS in E-Logo Purchasing Portal (all versions before 1.52) by Logo Software Industry and Trade Inc. permits authenticated low-privilege users to inject persistent malicious scripts that execute in the browsers of other portal users. The CVSS scope change (S:C) confirms the payload crosses trust boundaries, enabling session hijacking, credential theft, or unauthorized actions against procurement administrators and reviewers who visit affected pages. No public exploit code or CISA KEV listing has been identified at time of analysis.