This vulnerability is a classic stored XSS flaw that allows an attacker to inject malicious scripts into content managed by Bimser Solution Software Trade Inc.’s eBA Plus Document and Workflow Management System. The injected script can then run whenever any user views the affected document, potentially compromising that user’s session, stealing credentials, or defacing pages. The weakness is classified under CWE‑79 for improper input neutralization.*

All customers running eBA Plus versions 6.7.141 through, but not including, 10.0.11 are vulnerable. The affected product is the Document and Workflow Management Solution provided by Bimser Solution Software Trade Inc., commonly deployed in enterprise content management environments.

With a CVSS score of 5.4 the flaw is considered moderate severity; the EPSS score is not available, and the vulnerability is not in the CISA KEV catalog. The likely attack scenario involves submitting malicious content via the web interface—typically through a form that stores data for later retrieval—after the user or administrator inputs the data. Compromise can occur if an attacker can deliver the payload to a victim who then opens the stored document.*