A stored cross‑site scripting flaw in the SNS enrollment portal allows an attacker to embed malicious script code into a new user record. The injected payload is persisted and only executed when an administrator opens the user validation page. This gives the attacker the ability to run arbitrary JavaScript in the context of the administrator's browser with any privileges held by that account.

Stormshield Network Security customers using SNS 5.1.4 EA, SNS 5.0.10, SNS 4.8.20 LSTB, or SNS 4.3.45 QS are affected. These versions contain the vulnerable user‑creation form that is not properly sanitized before storage.

The CVSS score of 7.1 signals a high severity. The flaw can be exploited remotely through the freely accessible captive portal, bypassing the need for privileged authentication. Because the stored script is only triggered when an administrator validates a new user, an attacker would need to either wait for that action or force the portal to perform validation. There is currently no workaround; the vulnerability is not listed in CISA KEV and EPSS data is not available.