Privilege escalation via stored XSS

Stored XSS in Otalio Ship Property Management System before 2.22.0 lets authenticated attackers hijack accounts via the application security page. Stored values on that page are rendered without output encoding, and Mandiant demonstrated saving a payload that injects a script element and loads attacker-controlled JavaScript when the page is viewed. Exploitation requires valid access to place the payload and a user with sufficient privileges to open that page and change that user's own password, after which the script can take over the viewed account and act with that user's permissions.