Authenticated script execution via filename rendering

Cross-site scripting in attachment handling in OutSystems Service Center before 11.41.2 allows remote authenticated users to execute script via a crafted filename. The client-side file-attachment workflow writes an attacker-controlled filename into DOM content while a file is being prepared for upload, so JavaScript embedded in the filename executes because the value is not safely encoded before insertion. Low-privileged access is required, and exploitation reaches any Service Center location that supports file attachment; the published scoring confines direct impact to browser-context actions against the viewing user's session.