An authenticated user with low privileges can inject arbitrary JavaScript that is stored by Vinna Process Monitor and later served to other users. The persisted script can read the victim’s session cookie and other sensitive information, enabling the attacker to obtain administrative credentials and take over the application.

Skilja GmbH’s Vinna Process Monitor, version 4.0 Service Pack 1 (Build 63255). No other versions or vendors are listed as affected in this advisory.

The CVSS score of 9.3 signals a critical risk. Although the EPSS score is not provided, the flaw requires only legitimate credentials that are readily available to many users, making the attack path relatively easy. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly disclosed exploits yet, but the stored‑XSS nature means an attacker who authenticates can persist malicious code and exfiltrate tokens at any time. The likely attack vector is the web interface where the attacker submits malicious content that is later rendered to other users.