A reflected cross‑site scripting vulnerability allows an authenticated attacker to inject arbitrary JavaScript into the mensagem query parameter of the /Configuracao/Imagens.aspx endpoint. When the target page is viewed by a victim, the unsanitized input is reflected and executed in their browser, enabling the attacker to run code in the context of the application. Based on the description, it is inferred that such injected code could be used for session hijacking, credential theft, or other malicious actions within the victim’s session, though these specific outcomes are not explicitly stated.

The flaw exists in EMX Tecnologia Gestao X Business Suite version 8.4 and earlier. Any deployment of these versions that exposes the /Configuracao/Imagens.aspx endpoint with the mensagem parameter is vulnerable.

Because the vulnerability is reflected but requires authentication, exploitation is limited to attackers with legitimate access. An authenticated attacker can use crafted requests to inject malicious scripts, which are then reflected and executed when a victim views the page, potentially allowing session hijacking or other malicious actions. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. Without a patch, the risk remains for systems whose users could be targeted.