CVE-2025-9211

MediumCVSS 6.7

Published: 18/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

Otalio Ship Property Management System before version 2.22.0 contains a vulnerability due to unescaped stored values in the application security page. Authenticated attackers can escalate privileges via persistent cross-site scripting (XSS).

Risk Assessment

An attacker could exploit persistent XSS to hijack sessions of other users, potentially leading to privilege escalation and system security breaches.

Recommendation

Upgrade Otalio Ship Property Management System to version 2.22.0 or later, which includes the fix.

Original NVD description (English source)

Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via persistent cross-site scripting