Account takeover via stored self-service script injection

Stored XSS in VeridiumID before 3.5.0 allows remote authenticated users to take over accounts through the self-service portal. The self-service portal stores attacker-controlled input without adequate neutralization, and the admin portal renders it as executable script. A valid self-service account is required, and execution in an administrator's browser exposes the authority needed to compromise every account.