The vulnerability permits the injection of arbitrary client‑side script into the system status page of ISPConfig 3.3.0. An attacker with the ability to trigger the vulnerable page can run scripts in the context of any user who visits that page, potentially exfiltrating session data, modifying displayed information, or executing additional malicious actions that depend on the target's privileges. The flaw is a classic reflected XSS weakness.

The web‑based hosting control panel ISPConfig, version 3.3.0, is affected. No other versions or vendor variations are listed in the available data.

The CVSS base score is 4.7, indicating a medium severity. No EPSS score is currently available, but the vulnerability is not listed in CISA’s KEV catalog, suggesting that publicly available exploits are not yet widespread. The likely attack vector is remote via the web interface; exploitation requires a user to view the system status page, which may be protected by authentication. Because the exposed page may be accessed by administrators, the potential impact of a successful attack is significant if the page is not properly restricted.