CVE-2025-9211CWE-79cross-site-scripting

CVE-2025-9211

Medium · published August 18, 2026

CVSS v3.1
6.7
EPSS
0%
Percentile
39.7
In the wild
Unconfirmed
What it is

Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via persistent cross-site scripting

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00470 · 39.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-18T23:16Z
References (2)
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0024.md · [email protected]https://www.otalio.com/solutions/ · [email protected]
EPSS history
Timeline
  • 18 AUG 18:25Z
    Cross-site scripting in Otalio Ship Property Management System
    cvelistv5