LEX Baza Dokumentów is vulnerable to a DOM‑based cross‑site scripting flaw through the "em" cookie parameter. The application processes this cookie value on the client side without proper sanitization, which allows an attacker to inject arbitrary JavaScript that executes in the victim’s browser context. This weakness corresponds to CWE‑79 and results in the compromise of confidentiality, integrity, or availability only within the victim’s session, as the payload runs in the client’s environment.

The affected product is Wolters Kluwer Polska LEX Baza Dokumentów. Vulnerable versions are those released before the security patch that shipped in version 1.3.4. No other specific release identifiers are provided.

The CVSS score of 4.6 places the vulnerability in the medium category, and the EPSS score is unavailable; the issue is not listed in the CISA KEV catalog. Exploitation requires the attacker to set or spoof the "em" cookie for the target domain, which is typically achievable only if the attacker can influence the victim’s browser (e.g., through a malicious site or phishing). Because the attack surface is limited to client‑side cookie manipulation, the practical risk is considered minimal, but the vendor still released a patch to mitigate the flaw.