The vulnerability allows arbitrary script payloads to be stored in the Organization name field without any sanitization. When an attacker submits a malicious name, the application writes the payload to the database and later renders it directly into a web page. The stored script executes in the browsers of any user who views the organization’s details, giving the attacker the ability to run client‑side code in that context.

Bacularis product versions 5.4.0 through 6.5.1—including all releases in that range—are affected, regardless of the deployment environment or hosting configuration.

The CVSS score of 6.1 indicates moderate severity. An EPSS score of <1% and the absence from CISA’s KEV catalog suggest that exploitation is currently unlikely. The likely attack vector is the web interface that accepts organization names, inferred from the description of unsanitized input into that field. Successful exploitation requires an attacker to supply a crafted organization name, after which the stored payload triggers when the page is rendered.