Description

Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user's browser.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-11T20:18:37.837Z",
  "pubdate": "2026-08-11T20:18:37.837Z",
  "executiveSummary": "Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified within GMS version 9.5.1 (Build 9510.1044) and all preceding versions. These security flaws permit remote, unauthenticated or authenticated attackers to inject malicious JavaScript into the application's response payload, which subsequently executes within the context of a victimized user's browser session. The primary impact of these vulnerabilities includes session hijacking, credential theft, unauthorized execution of administrative or user-level actions, and arbitrary interaction with the vulnerable web application on behalf of the victim. The affected systems encompass GMS deployments running vulnerable software builds, exposing organizations to client-side code execution risks. Exploitation of these vectors typically requires an attacker to successfully trick a user into interacting with a crafted URL or malicious link, or leveraging persistent injection points if present. The risk implications are severe, as successful client-side exploitation can completely compromise the confidentiality and integrity of the user's session and lead to lateral movement within the application ecosystem.",
  "technicalDetails": "The identified vulnerabilities stem from improper neutralization of user-supplied input prior to reflection or storage within the application interface, characterizing standard Cross-Site Scripting (XSS) vectors. Specifically, GMS versions 9.5.1 (Build 9510.1044) and earlier fail to adequately sanitize, encode, or validate parameters processed by the web application components before rendering them in HTTP responses to client browsers.\nThe root cause is rooted in the lack of context-aware output encoding across vulnerable input handling routines. When a remote attacker submits specially crafted input containing executable JavaScript payloads via HTTP requests, the application fails to neutralize special characters such as angle brackets (< and >), quotation marks, and event handler attributes.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious URI or payload containing arbitrary JavaScript designed to execute within the victim's browser session. Second, the attacker induces a targeted user to access the malicious link or input vector through social engineering, phishing, or direct injection methods. Third, the GMS server processes the request and reflects or stores the unsanitized input within the HTTP response body without applying proper HTML or JavaScript encoding. Fourth, the victim's browser receives the response, parses the malicious payload as active script content rather than inert text data, and executes the JavaScript within the security context of the vulnerable domain.\nBecause the payload executes inside the victim's browser session, it inherits the session privileges and Document Object Model (DOM) access rights of the authenticated user. Consequently, post-exploitation capabilities include reading sensitive data from the DOM, accessing cookies and local storage tokens, performing unauthorized actions on behalf of the user, and potentially escalating privileges if the victim operates with administrative rights within GMS. Network exposure is inherent to any deployment accessible over HTTP or HTTPS where remote users interact with the vulnerable application interface. Authentication and privilege requirements vary depending on the specific injection endpoint, but exploitation generally relies on network accessibility to the vulnerable GMS instance and browser interaction from a targeted user."
}