The vulnerability is an input sanitization flaw that allows stored cross‑site scripting in web pages. An attacker can inject malicious scripts that execute in the browsers of users who view the affected content. The potential consequences such as cookie theft, session hijacking, defacement, or unauthorized data exfiltration are typical outcomes of stored XSS, and are therefore inferred from nature of the flaw rather than described directly in the CVE data.

DivvyDrive Information Technologies Inc.'s DivvyDrive product is impacted. Versions starting with 4.8.2.23 up to (but not including) 4.8.3.1 contain the flaw. Systems running any of those releases require remediation.

The CVSS score of 5.4 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting low or unknown exploitation likelihood. The CVE description does not state an explicit attack vector; it is inferred that a stored XSS attack can be invoked remotely by submitting malicious input that is persisted on the server and later displayed to authenticated or unauthenticated users. Because attackers can trigger the payload via a variety of HTTP requests, the attack vector is inferred to be remote, though local access to the application could also suffice. Given the lack of public exploit evidence, the risk remains moderate, but the vulnerability can still enable significant user‑level compromise.