The CVE describes a reflected Cross‑Site Scripting vulnerability in HCL DevOps Plan. The flaw resides in the way untrusted user data is incorporated into web pages without proper sanitization or encoding. If an attacker can force a victim’s browser to load a specially crafted page that contains malicious script, the code will execute within the context of the user’s session. This may allow the attacker to steal session cookies, manipulate the page, or carry out other client‑side attacks. The weakness is classified as CWE‑79.

The affected product is HCL Software’s DevOps Plan. The CNA disclosure does not specify affected versions; therefore any installation of the product that receives the dependent component of DevOps Plan should check the latest advisories and verify their version. No other vendors or product lines are known to be impacted from this announcement.

The CVSS score of 2.3 indicates a low overall risk, and the EPSS score of < 1 % suggests that field exploitation is uncommon. The vulnerability has not been listed in the CISA KEV catalog, further implying limited or no known exploit activity. Because the flaw is client‑side, an attacker would need to deliver a malicious page, often via phishing or compromised content, and rely on a browser bug or misconfiguration to succeed. The resulting impact is confined to the victim’s browser session and does not alter server‑side data or privileges.