Cross Site Scripting Vulnerability in Polarion Before V2506

An authenticated user with access to Polarion could inject malicious scripts that execute in other users' browsers when they view affected pages, potentially allowing credential theft or unauthorized actions on their behalf.

Organizations using Siemens Polarion application development and collaboration platform. Any team member with Polarion access could be affected if they view content created by an attacker.

An attacker with valid Polarion credentials creates a malicious input (e.g., in a project description, comment, or custom field) containing JavaScript. When other users view that content in their browsers, the script executes in their session context, allowing the attacker to steal session cookies or perform actions as those users.