ProjeQtor versions 7.0 through 12.4.3 contain a stored cross‑site scripting flaw in the checkValidHtmlText() function within Security.php. The function attempts to sanitize user input but only detects specific patterns and returns the string unescaped, allowing attackers to inject malicious HTML content such as img tags with event handlers. When a user opens a page that displays the stored content, the browser executes the injected code, enabling the attacker to alter the appearance of the application or run arbitrary scripts in the victim’s browser.

Affected are installations of the ProjeQtor web application running any version from 7.0 up to, but not including, 12.4.4. This includes both the Community Edition and Enterprise Edition released by the ProjeQtor project.

The CVSS score of 5.1 indicates a medium impact. Because the vulnerability is stored, an attacker only needs to submit a crafted payload via any input field that accepts HTML, which is then persisted and later rendered for any user with sufficient access to view the content. Although an EPSS score is not available and the issue is not listed in the CISA KEV catalog, the flaw remains exploitable by anyone who can interact with the application’s input regardless of authentication level.