A cross‑site scripting flaw exists in Plunet BusinessManager, allowing attackers to inject malicious scripts into the web interface. The vulnerability can result in theft of session cookies, sensitive data, and execution of unauthorized actions on behalf of the user. This is an input validation failure (CWE‑79).

Plunet BusinessManager, distributed by Plunet, is affected. The flaw resides in version 10.15.1; versions starting with 10.22.3 contain a fix and are no longer vulnerable.

The CVSS score of 8.7 classifies the issue as high severity. The EPSS score is under 1 %, indicating a very low current exploitation probability, and it is not listed in CISA’s KEV catalog. The likely attack vector is inferred to be web‑based, requiring the attacker to deliver malicious payloads through user‑supplied input that the application fails to sanitize. If a victim visits a crafted page, the attacker could hijack the session and perform actions with the victim’s authority. While no public exploit is documented, the high severity and potential for automated attacks warrant swift remediation.