This vulnerability is a stored XSS flaw caused by improper neutralization of user input during web page generation. An attacker can inject malicious scripts that will execute in the browsers of any users who view the affected pages, potentially enabling session hijacking, defacement, or phishing attacks. The weakness corresponds to CWE-79.

Fileorbis Informatics Services Trade Inc.'s FileOrbis product is vulnerable in all versions prior to 16.5.

The CVSS score of 5.4 places this vulnerability in the medium severity range. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation is currently known. Exploitation requires the attacker to supply input that is later rendered by the application, typically through a form or upload interface, so an attacker with access to the data entry functions can inject malicious content. Once stored, the script runs in the victim’s browser, allowing the attacker to steal session cookies or execute further client‑side attacks. The attack vector is likely web‑based, relying on the application’s failure to properly escape or sanitize user‑supplied data.