Victim-browser script execution via stored demographic content

Stored XSS in affected Enterprise Health builds allows remote authenticated users to inject content that executes in a victim's browser. The Demographic Information page stores attacker-supplied content and later renders it as executable browser content rather than inert text. A valid account is required to plant the content, and a victim must open the affected page before the injected content runs.