Census CSWeb 8.0.1 stores unsanitized user input, allowing a remote authenticated attacker to embed malicious JavaScript. When another user views the stored data, the script runs in that user's browser, enabling session hijacking, cookie theft, or data exfiltration. The weakness is a classic stored XSS flaw (CWE‑79).

Vendor Census CSWeb version 8.0.1 is affected. No other versions or products are listed in the CNA data.

The CVSS score of 5.1 indicates moderate risk; the EPSS score is below 1% and it is not listed in the CISA KEV catalog, suggesting low current exploitation likelihood. Exploitation requires the attacker to be authenticated to the application, after which malicious input can be stored and later presented to other users. The attack vector is through the web interface, with no requirement for network‑level access beyond valid credentials.