A stored cross‑site scripting flaw has been identified in Plunet BusinessManager. Malicious JavaScript can be entered by an attacker, stored in the system, and later displayed in browsers of other users. The description states that this flaw allows attackers to perform unauthorized actions on behalf of privileged users, implying that the injected code can execute with the victim’s session privileges. The root cause is not explicitly provided, but the nature of the defect suggests that input is not properly sanitized or encoded before being rendered, an inference drawn from the wording of the description.

Affected product: Plunet BusinessManager, version 10.15.1. The vendor published a fix in version 10.20 and later; earlier releases are not listed as vulnerable.

The CVSS score of 8.6 classifies the vulnerability as high severity. The EPSS score is below 1%, indicating that current exploitation is unlikely, yet the flaw remains dangerous if an attacker can inject payloads. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to reach an input interface that accepts data—potentially an authenticated user or any entity able to submit information—to embed malicious scripts that will execute in other users’ browsers.