A stored cross-site scripting vulnerability in Jet Admin allows authenticated attackers to execute arbitrary JavaScript in the browser context of other users.

This is a stored cross-site scripting (XSS) vulnerability (CWE-79) residing in the sign-in page configuration. An authenticated attacker with access to the scripts and styles option can inject malicious JavaScript that executes when other users visit the sign-in page.

With a CVSS score of 7.3, this vulnerability poses a significant risk to organizational security. Successful exploitation allows an attacker to steal session cookies, hijack user accounts, or manipulate data within the victim's browser context, potentially leading to unauthorized access to sensitive administrative functions.

Immediate Action: Apply vendor security updates immediately as provided by Jet Admin.

Proactive Monitoring: Review application access logs for unusual activity on the sign-in page and monitor for anomalous script execution patterns.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter malicious input strings.

Public Exploit Available: Unknown.

This vulnerability requires prompt attention due to its potential for account takeover. Administrators should prioritize applying the latest security patches and ensure that administrative interfaces are restricted to authorized personnel only to limit the exposure of the vulnerable configuration options.