LUNA Imaging Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in LUNA software version 7.5.5.6. This issue allows an attacker to execute JavaScript in the victim's browser by injecting a malicious payload through the 'Edit Batch Name' feature. The application stores this payload and later displays it without adequate sanitization, exposing it to other users. Exploitation of this vulnerability could lead to the theft of sensitive user information, such as session cookies, or allow actions to be performed on behalf of the user.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected content.