The vulnerability resides in the note editor of the Protectel modules PROTECTELMAJ and BDF. A low‑privileged attacker can inject arbitrary HTML or JavaScript into stored notes; when a user later opens the note, the payload is rendered and executed in the user's browser.

Affected products are Arketeam's Protectel modules PROTECTELMAJ and BDF. The flaw exists in all releases prior to PROTECTELMAJ v6.5.19 and BDF v6.4.67, and the note editor is a core component accessed by any user with write permissions.

The CVSS score of 5.1 indicates a medium severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting a low to moderate exploitation probability at present. An attacker only needs access to the note editor—available to any user with write privileges—to craft and store the malicious payload; no special external access is required.