Persistent Cross-Site Scripting in Otalio Ship Property Management System
CVE-2025-9211

6.7MEDIUM

Key Information:

Vendor

Otalio

Status
Ship Property Management System
Vendor
CVE Published:
18 August 2026

What is CVE-2025-9211?

The Otalio Ship Property Management System is susceptible to persistent cross-site scripting due to unescaped stored values in the application security page. This vulnerability allows authenticated attackers to escalate their privileges by injecting malicious scripts, which can subsequently execute in the context of other users accessing the affected application.

Affected Version(s)

Ship Property Management System 0 < 2.22.0

References

https://www.otalio.com/solutions/
product
https://github.com/mandiant/Vulnerability-Disclosures/blo...
third-party-advisory

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.