Worksuite Saas
Monthly
Stored cross-site scripting in Worksuite SaaS Asset Management allows authenticated administrators to persist arbitrary JavaScript into the application database via the Location and Description fields of the asset creation form. All users who subsequently view an affected asset - regardless of their own privilege level - will execute the injected script in their browser, enabling session hijacking, credential theft, and unauthorized actions performed within their authenticated session context. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 4.6 (Medium) reflects the high-privilege prerequisite that meaningfully constrains the attack surface.
Stored cross-site scripting in Worksuite SaaS Asset Management allows authenticated administrators to persist arbitrary JavaScript into the application database via the Location and Description fields of the asset creation form. All users who subsequently view an affected asset - regardless of their own privilege level - will execute the injected script in their browser, enabling session hijacking, credential theft, and unauthorized actions performed within their authenticated session context. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 4.6 (Medium) reflects the high-privilege prerequisite that meaningfully constrains the attack surface.