GestSup versions prior to 3.2.60 allow an attacker to inject attacker‑controlled HTML or JavaScript into API error logs by sending a crafted X‑API‑KEY header with an unauthenticated request. The injected payload is stored and later rendered in the web interface without proper output encoding, enabling arbitrary script execution in the administrators’ browser, which can lead to session hijacking or other malicious actions.

The vulnerability affects the GestSup product, specifically all releases prior to version 3.2.60. No other products or vendors are listed as affected.

The CVSS score of 5.1 classifies the issue as moderate severity, while the EPSS score of less than 1 % indicates a very low likelihood of exploitation at the time of analysis and the vulnerability is not listed in the CISA KEV catalog. The attack can be performed from any network location without authentication, typically by forging an HTTP request to the API endpoint (e.g., /api/v1/ticket.php). Because the payload is stored and executed only when an administrator views the log entries, the window of exploitation is limited to when privileged users access the logs. Nonetheless, the potential for compromising an admin session remains.