The vulnerability is a stored cross‑site scripting flaw located in the application security page of the Otalio Ship Property Management System. Because user‑supplied data is not properly escaped before being rendered, an attacker who is already authenticated can inject malicious script code that is persisted and later executed in the browser of other users or even administrators. This persistent XSS can be leveraged to elevate privileges, allowing the attacker to perform actions with higher authority than originally granted. The weakness aligns with CWE‑79, which describes improper neutralization of entry points that allow malicious content to be injected.

The flaw is present in versions of the Otalio Ship Property Management System that are earlier than 2.22.0. Any deployment running a version dated before 2.22.0 should be considered vulnerable. The impact applies to authenticated users who can access the application security page, so all installations that enable user accounts capable of interacting with that page are at risk.

The CVSS score of 6.7 indicates a medium severity risk, but the lack of an EPSS value leaves the actual exploitation probability uncertain. The vulnerability is not listed in CISA's KEV catalog, suggesting no publicly known exploits yet. The attack step requires legitimate authentication and the ability to modify stored values, so attackers would first need to compromise a valid account or entice a user to supply the injected payload. Once the script is stored, it will execute during subsequent page loads, potentially allowing the attacker to hijack sessions, deface content, or gain elevated permissions.