A DOM-based Cross-Site Scripting vulnerability in Connect-CMS versions 1.35.0 through 1.41.0 and 2.35.0 through 2.41.0 poses a significant risk of unauthorized script execution.

This is a DOM-based Cross-Site Scripting (XSS) vulnerability located within the Cabinet Plugin list view. The vulnerability requires the attacker to be authenticated as a low-privileged user and relies on user interaction to execute the malicious payload.

Successful exploitation allows an attacker to inject arbitrary scripts into the victim's session, which can lead to session hijacking, unauthorized actions performed on behalf of the user, or the theft of sensitive session tokens. With a CVSS score of 8.7, this vulnerability is classified as High severity, reflecting the potential for significant impact on user confidentiality and data integrity within the platform.

Immediate Action: Upgrade to Connect-CMS version 1.41.1 or 2.41.1 to incorporate the vendor-supplied security patch.

Proactive Monitoring: Review web server and application logs for suspicious characters or unusual patterns in query parameters that might indicate attempts to inject malicious scripts into the Cabinet Plugin view.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets configured to detect and block common XSS attack patterns targeting input fields and URL parameters.

Public Exploit Available: Unknown.

Given the High severity of this vulnerability and the availability of official patches, administrators should prioritize the update process for all affected Connect-CMS instances. Organizations should verify their current versioning and apply the relevant 1.41.1 or 2.41.1 release immediately to eliminate the risk of script injection attacks.