Altium 365 Stored Cross-Site Scripting Vulnerability in User Profile Text Fields

A stored cross-site scripting vulnerability has been identified in Altium 365 user profile text fields. This issue arises from inadequate server-side input sanitization, which enables authenticated users to inject arbitrary HTML and JavaScript payloads. The vulnerability exploits whitespace-based attribute parsing bypass techniques. Once injected, the payload is persisted and executed when other users view the affected profile page. This could lead to session token theft, phishing attacks, or malicious redirects. Exploitation requires an authenticated account and user interaction to view the modified profile.

Impact

Successful exploitation allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the profile.