The identified flaw is a stored cross‑site scripting (XSS) vulnerability in DumbAssets version 1.0.11. Asset fields such as name, description, modelNumber, serialNumber, and tags are saved without server‑side sanitization and then rendered using innerHTML with no client‑side escaping. An attacker can inject JavaScript when creating or updating an asset via the API. When a user views the asset list, the malicious script executes in that user’s browser. If a Content‑Security‑Policy is not enabled, the script can establish unrestricted connections to internal services, potentially exfiltrating data or performing other malicious actions.

The affected product is DumbWareio’s DumbAssets, all installations using version 1.0.11 are vulnerable. Updates released after this version contain the fix.

The CVSS base score of 5.3 indicates Medium severity. EPSS is not reported, and the vulnerability is not listed in the CISA KEV catalog. The most likely exploitation path requires an attacker to authenticate or otherwise gain the privilege to create or modify assets via the asset API. Lacking a Content‑Security‑Policy, the injected payload can reach internal network services, meaning a successful exploit could lead to data theft, further compromise, or improper privilege escalation. Even without a CSP, the script would still run in the affected user’s browser, so the attack vector is a web‑based XSS via the asset API.