A stored cross‑site scripting vulnerability exists in the /msg/msgInner/save endpoint of JeeSite v5.15.1. Malicious actors may inject crafted content into the msgContent field, causing the web application to store and later serve executable scripts or HTML to visiting users. This can lead to session hijacking, data theft or defacement of displayed content. The weakness is classified as CWE‑79, a classic stored XSS flaw.

The affected system is JeeSite v5.15.1 released by thinkgem. The vulnerability is tied specifically to the /msg/msgInner/save endpoint and the msgContent parameter in that version; no other products or versions are listed as impacted.

The CVSS score of 6.1 indicates moderate severity. Exploitation requires an attacker to submit malicious input via the msgContent field and rely on end‑users to visit a page that displays the stored payload. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. While the impact is limited to the victim’s browser session, the attack vector is web‑based and can be leveraged by attackers with readily available tools.