Philipp Rieth

**Name of the Vulnerable Software and Affected Versions** COINS Construction Cloud version 11.12 **Description** An issue was discovered due to insufficient neutralization of user input in the description of a task, allowing malicious JavaScript code to be stored and later executed when reflected back to the user. **Recommendations** For COINS Construction Cloud version 11.12, consider disabling the task description feature until a patch is available to prevent the storage and execution of malicious JavaScript code. Restrict access to task descriptions to minimize the risk of exploitation. Avoid using the task description field in COINS Construction Cloud until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.