CVE-2024-37828

Vermeg Agile Reporter stores an unsanitized value from the Broadcast Message field and replays it as active script when others view it, a stored cross-site scripting flaw. The twist that shapes the risk is the entry requirement: injecting the payload needs high privileges, since the broadcast-message module isn't something a low-level user can reach.

Because the person planting the script must already be highly privileged, this is closer to a trust-abuse or insider scenario than an external attack, and its impacts are rated low across the board with only a scope change nudging it upward. A stored XSS that requires admin-level access to set, and then still depends on a victim viewing it, is a narrow path with a modest payoff.

We rank this below its 4.8 for most deployments and handle it as ordinary application hygiene. The realistic value is in defense-in-depth: assuming a privileged account can be misused, output encoding on that field would prevent the script from ever executing. We'd fold the fix into a normal update rather than treating a high-privilege-gated, low-impact XSS as anything urgent.