TranzAxis 3.2.41.10.26 suffers a stored cross‑site scripting flaw that can be triggered by an authenticated user through the "Open Object in Tree" endpoint. The vulnerability allows the injection of malicious JavaScript which, when executed in a victim’s browser, can read and exfiltrate session cookies. Because the script is stored, any subsequent user who views the compromised content may be affected, potentially allowing escalation of privileges if the attacker can manipulate authenticated sessions.

The affected product is TranzAxis version 3.2.41.10.26 distributed by Compass Plustechologies. No other versions are mentioned as vulnerable. The flaw resides in the server‑side handling of the "Open Object in Tree" API and requires the user to be authenticated to perform the injection.

The flaw’s CVSS score of 5.3 indicates moderate severity. The EPSS score is reported as < 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need valid user credentials to access the vulnerable endpoint; if such credentials exist, the stored XSS could compromise additional users’ sessions and lead to unauthorized privileged actions. Existing defensive controls such as web application firewalls or input sanitization could mitigate the risk, but the most effective countermeasure is to remediate the affected application.