A stored cross-site scripting vulnerability in UnoPim allows authenticated users to execute malicious scripts, posing a significant risk to administrative session integrity.

The application fails to properly sanitize SVG file uploads, allowing an attacker with administrative privileges to bypass security filters. This occurs specifically within the /admin/settings/users/create endpoint, enabling the storage of malicious scripts that execute in the context of other users.

Successful exploitation of this cross-site scripting vulnerability could allow an attacker to hijack administrative sessions, steal sensitive session tokens, or perform unauthorized actions on behalf of other users. Given the CVSS score of 8.0, this flaw represents a high risk to organizational data integrity and administrative control over the Product Information Management system.

Immediate Action: Update the UnoPim installation to version 0.2.1 or later to implement the necessary SVG sanitization patches.

Proactive Monitoring: Audit administrative logs for suspicious file upload activity or unusual script execution patterns within the user creation module.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block malicious SVG uploads or scripts targeting administrative endpoints.

Public Exploit Available: Unknown

The presence of a proof-of-concept and the high CVSS score necessitate immediate attention. Organizations utilizing UnoPim should prioritize upgrading to version 0.2.1 to close the sanitization gap, as this is the only definitive way to prevent stored XSS attacks via this vector.