{“lastseen”:””,”description”:”Stored cross-site scripting (XSS) vulnerability in the LMT Dashboard of the Perx Customer Engagement \\u0026 Loyalty Platform allows an authenticated attacker to execute arbitrary JavaScript code in a victim’s browser. The vulnerability is due to improper sanitization of SVG file uploads. An attacker can upload a malicious SVG file containing a script payload to a campaign. When another user views this image on the public LMT microsite, the script executes, which can lead to session hijacking, data theft, or other unauthorized actions.This issue affects Customer Engagement \\u0026 Loyalty Platform before 4.617.4.”,”published”:”2025-10-27T07:39:54.263Z”,”modified”:”2025-10-27T07:39:54.263Z”,”type”:”cve”,”title”:”Stored Cross-Site Scripting in Perx Customer Engagement \\u0026 Loyalty Platform”,”source”:”NCSC.ch”,”references”:”https:\/\/www.redguard.ch\/blog\/2025\/10\/27\/advisory-perx-lmt-dashboard\/”,”id”:”CVE-2025-11682″,”bulletinFamily”:””,”cwe”:[“CWE-79″,”CWE-83″],”cvelist”:null,”sourceData”:”Perx Technologies Customer Engagement \\u0026 Loyalty Platform 0″,”sourceHref”:””,”cvss”:{“score”:7.1,”severity”:”HIGH”,”vector”:”CVSS:4.0\/AV:A\/AC:H\/AT:N\/PR:H\/UI:A\/VC:H\/VI:H\/VA:N\/SC:H\/SI:H\/SA:L”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Customer Engagement \\u0026 Loyalty Platform”,”version”:”0″,”vendor”:”Perx Technologies”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”Stored cross-site scripting (XSS) vulnerability in the LMT Dashboard of the Perx Customer Engagement \\u0026 Loyalty Platform allows an authenticated attacker to execute arbitrary JavaScript…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,50,12,15,13,7,11,5],"class_list":["post-23441","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-71","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n