DivvyDrive Information Technologies Inc. has identified a stored cross‑site scripting vulnerability. The flaw arises from improper neutralization when web pages are rendered, allowing a malicious actor to embed scripts that will execute in the browser context of any user who views the affected content.

The issue impacts the DivvyDrive product line. Versions starting with 4.8.2.9 and running up to (but not including) 4.8.3.2 are vulnerable. Any deployment of those specific builds that accepts user input without proper sanitization is at risk.

The CVSS score of 8.8 indicates high severity, and while an EPSS score was not reported, the lack of exploitation data does not diminish the potential for abuse. The vulnerability is not yet listed in CISA KEV. Likely attackers can exploit it by injecting malicious code through any input channel that stores content, such as comments, messages, or data fields. If successful, the attacker’s script would run with the privileges of the victim’s browser session.