Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allows Stored XSS. This issue affects FileOrbis: before 16.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-18T11:16:50.287Z",
  "pubdate": "2026-08-18T11:16:50.287Z",
  "executiveSummary": "An improper neutralization of input during web page generation vulnerability, commonly known as Stored Cross-Site Scripting (XSS), has been identified in FileOrbis Informatics Services Trade Inc. FileOrbis. This security flaw exists due to insufficient sanitization and validation of user-supplied input before rendering it back within the context of a web page.\nThe vulnerability affects FileOrbis versions prior to 16.5. Successful exploitation of this flaw allows an authenticated attacker to inject arbitrary malicious scripts, typically JavaScript, into the application's persistent storage. When other users or administrators access the compromised page or view the affected resource, the malicious payload executes within the security context of their active browser session.\nThe potential impact of this vulnerability includes session hijacking, credential theft, unauthorized actions performed on behalf of the victim, and potential manipulation of the web application's interface. The risk implication is significant as it compromises the confidentiality and integrity of user sessions within the application ecosystem. Remediation requires updating FileOrbis to version 16.5 or later where the input neutralization logic is properly implemented.",
  "technicalDetails": "The vulnerability is rooted in the improper neutralization of input during web page generation, specifically manifesting as a Stored Cross-Site Scripting (XSS) vulnerability within FileOrbis versions prior to 16.5. The root cause stems from the application accepting user-supplied data without enforcing strict input validation or contextual output encoding before storing the data in the backend database and subsequently rendering it in the Document Object Model (DOM) to other users.\nThe attack flow begins when an adversary submits crafted malicious input containing executable script tags or event handlers through an input vector processed by the vulnerable component of FileOrbis. The application fails to sanitize this input and persists the payload within the database or file system storage. When a targeted user navigates to the application interface that retrieves and displays the stored data, the server incorporates the raw, unescaped payload into the generated HTML response.\nUpon receiving the HTTP response, the victim's browser parses the content and executes the embedded script within the context of the user's session, possessing the same Document Object Model (DOM) access, cookies, and local storage tokens. Depending on the privileges of the victim, this can range from standard user session compromise to administrative account takeover. Network exposure is inherent to web-based applications accessible over HTTP/HTTPS protocols. Attackers generally require authenticated access to introduce the persistent payload into the application data flow, though the exact privilege level required depends on the specific vulnerable input vector within FileOrbis."
}