An issue was discovered in COINS Construction Cloud 11.12. Due to improper input neutralization it is vulnerable to reflected cross-site scripting (XSS) via malicious links (affecting the search window and activity view window).