A stored XSS vulnerability in Narkom Communication Pyxis Signage allows an authenticated administrator to execute arbitrary scripts, posing a significant risk to system integrity.

The application fails to properly neutralize user-supplied input, resulting in a stored XSS condition. Based on the CVSS vector (PR:H), this vulnerability requires an attacker to possess high administrative privileges to successfully inject malicious scripts.

Successful exploitation allows an attacker to execute malicious scripts within the context of the administrative interface, potentially leading to unauthorized data access, session hijacking, or the modification of digital signage content. With a CVSS score of 7.2, this vulnerability represents a high risk to organizational operations, particularly if the platform is integrated into critical communication infrastructure.

Immediate Action: Consult the official Narkom Communication security advisories for available patches or configuration changes to neutralize input fields.

Proactive Monitoring: Review web application logs for unusual script tags or obfuscated JavaScript patterns within administrative inputs.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict XSS filtering rules to inspect and block malicious payloads directed at the signage management interface.

Public Exploit Available: No

Given the high CVSS severity and the potential for persistent code execution within the administrative panel, organizations should treat this as a priority item. Administrators must restrict access to the management console to trusted personnel only and apply any forthcoming vendor patches immediately to remediate the underlying sanitization flaw.