CVE-2025-9211

MediumCVSS 6.7

Published: 18/08/2026(UTC)Updated: 29/09/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

38th percentile - higher than 38% of all known CVEs

Summary

Otalio Ship Property Management System before version 2.22.0 contains a vulnerability due to unescaped stored values in the application security page. Authenticated attackers can escalate privileges via persistent cross-site scripting (XSS).

Risk Assessment

An attacker could exploit persistent XSS to hijack sessions of other users, potentially leading to privilege escalation and system security breaches.

Recommendation

Upgrade Otalio Ship Property Management System to version 2.22.0 or later, which includes the fix.

Other vulnerabilities in Otalio Ship Property Management System

CVE-2025-9210High
Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System before version 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs.

Original NVD description (English source)

Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via persistent cross-site scripting

Vulnerability data from NVD (NIST) · CISA KEV · EPSS