The vulnerability is a stored cross‑site scripting flaw in RLE NOVA’s PlanManager application. An attacker can inject malicious JavaScript through the ‘comment’ and ‘brand’ parameters in the /index.php endpoint; the payload is saved by the system and displayed to other users without proper sanitization. This flaw can be exploited to steal session cookies or to perform actions on victims, compromising authentication integrity.

The affected product is RLE NOVA:PlanManager. The CVE data does not specify affected versions; the service at planmanager.es was taken offline in October 2025, eliminating the current exploitable surface, but any remaining deployments that remain online may still be affected.

The flaw carries a CVSS score of 6.9 and an EPSS score below 1 %, indicating a low but non‑zero exploitation likelihood, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is through the web interface’s input fields, typically requiring access to the web interface either via an authenticated user or by posting publicly accessible content. With the application offline, immediate risk is mitigated, but any online installations retain a moderate risk until input sanitization is applied or the service is shut down.