The z‑9527 admin application contains a flaw in the Message Create Endpoint located in /server/routes/message.js. When a message is submitted, user supplied data is rendered in a browser without proper sanitization, allowing an attacker to inject JavaScript. The result is cross‑site scripting that can run arbitrary code in the context of another user's browser session. The vulnerability relies on typical web request and response handling and does not require local access or privileged execution on the server.

The flaw affects the 1.0 and 2.0 releases of the z‑9527 admin component. No other product versions have been reported as impacted. Systems running either of these releases are exposed if the message creation functionality is enabled and not patched.

The CVSS base score of 5.1 indicates moderate severity, and EPSS data is unavailable. The publicly available exploit demonstrates that the attack can be carried out remotely by sending a crafted HTTP request to the vulnerable endpoint. The vendor has not provided a fix, and the vulnerability is absent from the CISA Known Exploited Vulnerabilities list, meaning it may be overlooked by automated defenses. The moderate score, lack of vendor remediation, and confirmed public exploit combine to make the risk significant for running installations.