PEM versions before 9.8.1 contain a stored Cross‑Site Scripting flaw that permits users who can create charts in the Manage Charts menu to inject malicious JavaScript. When a chart is viewed, the injected script runs in the victim’s browser. Because only the superuser and users with pem_admin or pem_super_admin roles can create charts, the impact is limited to these high‑privilege accounts but can affect any other user who opens the compromised chart, potentially exposing session data or enabling further attacks.

EnterpriseDB Postgres Enterprise Manager, all releases earlier than version 9.8.1, accessed via the Manage Charts feature.

The vulnerability carries a CVSS score of 6.5 and an EPSS of less than 1 %, indicating moderate severity but low expected exploit frequency. It is not listed in CISA’s KEV catalog. Exploitation requires authenticated access with pem_admin or pem_super_admin rights to create a chart, after which any user who subsequently opens the chart will have the attacker’s script executed. In typical deployments the attack surface is internal, but compromised privileged credentials or social‑engineering could provide the necessary access.