Ffxiv Teamcraft
Monthly
Stored cross-site scripting in FFXIV Teamcraft up to and including 11.4.31 lets comment content be rendered as trusted HTML in the desktop/Electron renderer, so an attacker who can post comments can execute script in the context of another user who later views them. Exploitation requires a low-privileged authenticated account to plant the payload and a victim to open the affected comment view, which keeps realistic impact at medium severity (CVSS 4.0 base 5.1, CWE-79); the network vector alone overstates the practical risk. No public working exploit code is confirmed - only a public proof-of-concept reference exists - and the issue is not listed as actively exploited; upgrading to 11.4.32 is the recommended fix and the vendor patch commit is public.
Stored cross-site scripting in FFXIV Teamcraft up to and including 11.4.31 lets comment content be rendered as trusted HTML in the desktop/Electron renderer, so an attacker who can post comments can execute script in the context of another user who later views them. Exploitation requires a low-privileged authenticated account to plant the payload and a victim to open the affected comment view, which keeps realistic impact at medium severity (CVSS 4.0 base 5.1, CWE-79); the network vector alone overstates the practical risk. No public working exploit code is confirmed - only a public proof-of-concept reference exists - and the issue is not listed as actively exploited; upgrading to 11.4.32 is the recommended fix and the vendor patch commit is public.