CVE-2025-9211

Published: Aug 18, 2026Modified: Aug 31, 2026

6.7

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Exploitability: 1.2 / Impact: 5.5

Source: mandiant-cve@google.com (Secondary)

Description

Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via persistent cross-site scripting

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0024.md

Source: mandiant-cve@google.com

https://www.otalio.com/solutions/

Source: mandiant-cve@google.com

Timeline

No history available yet.