A stored cross-site scripting vulnerability in iris-web 2.4.26 presents a credible risk of exploitation due to the existence of a proof-of-concept.

The application fails to properly neutralize input during web page generation, leading to stored XSS. An authenticated attacker with low privileges can leverage this to execute scripts in the victim's browser session.

The ability to execute arbitrary scripts in the context of other users poses a high risk of session theft and unauthorized data manipulation. In an incident response environment, this could allow an attacker to alter the course of an investigation or access sensitive evidence. The CVSS score of 7.6 indicates a high risk to the confidentiality and integrity of the application.

Immediate Action: Monitor official vendor channels for the release of a security patch and apply it to all instances of iris-web immediately upon availability.

Proactive Monitoring: Review web application logs for unusual script tags or character sequences frequently used in XSS attacks.

Compensating Controls: Implement a Web Application Firewall (WAF) to block malicious cross-site scripting payloads from reaching the application backend.

Public Exploit Available: Unknown

Due to the presence of a proof-of-concept, the urgency of this vulnerability is elevated. Security teams should treat this as a priority item and implement WAF protections immediately until a vendor-supplied patch can be deployed.