The vulnerability is an improper neutralization of script‑related HTML tags in Fileorbis, allowing an attacker to embed executable scripts into web pages that users will view. When a malicious file is uploaded or processed by the application, the unsanitized content can lead to client‑side script execution in the context of the affected user, potentially enabling session hijacking, credential theft, or other browser‑based attacks. The weakness is a classic stored XSS flaw (CWE‑80).

Fileorbis Informatics Services Trade Inc. Fileorbis versions prior to 12.5.4. No other product or version information is specified.

The CVSS score of 6.1 indicates moderate severity, but the lack of an EPSS rating means routine exploitation evidence is not known. The flaw is not currently listed in CISA KEV, suggesting no documented attacks yet. The likely attack vector is through file uploads or interactions with file upload functionality where a user with permission to upload can insert malicious HTML that is later rendered for other users. Successful exploitation would provide the attacker with client‑side script execution on victims’ browsers, which may be leveraged for phishing, credential theft, or other browser‑based attacks.