Cross-Site Scripting Vulnerability in ICO.Fraud

ICO.Fraud is an application that checks whether submitted service invoices are fraudulent. The application, developed by ICO-LUX GmbH, is susceptible to a cross-site scripting (XSS) vulnerability. Users can comment on ongoing checks in ICO.Fraud and thereby store arbitrary JavaScript code. Other users can view the check along with the tampered comments. As a result, the stored JavaScript code is executed in the user’s context.

The vendor has fixed the issue in version 1.40.1.

You will find detailed information about these security issues in our Security Advisory:

• SYSS-2026-073

You will find further information about our Responsible Disclosure Policy concerning the publishing process of SySS Security Advisories here.