Stored XSS via unescaped JSP output

Stored cross-site scripting in PrimeKey EJBCA through 7.9.0.2 allows low-privilege users to affect higher-privilege administrators via the Admin Web. The addendentity.jsp path stores attacker-controlled fields, and viewendentity.jsp renders those values without adequate output escaping, causing script execution when an administrator views the record. Exploitation requires an authenticated low-privilege account able to create or edit an end entity and a higher-privilege administrator to view the affected page; the demonstrated impact is cross-site data access and actions in that administrator's browser context.