A stored cross-site scripting vulnerability exists in the /api/blade-desk/notice/submit endpoint of SpringBlade version 4.8.0. When a user submits a notice containing malicious script in the content field, the input is stored and later rendered without proper encoding. This allows an attacker to execute arbitrary scripts or HTML in the browsers of other users who view the notice, potentially leading to session hijacking, credential theft, defacement, or malware delivery.

The flaw affects the SpringBlade e‑commerce framework, version 4.8.0. It is present in the API endpoint that accepts notice submissions.

The CVSS score of 6.1 indicates moderate severity. The EPSS score of 0.00029 (<1%) indicates a very low but nonzero probability of exploitation, and the flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the likely attack vector requires an attacker to have authenticated access to the /api/blade-desk/notice/submit endpoint, with permission to submit notices; therefore, the risk is higher in environments with broader write access to that endpoint.