The ITS Intelligent SCADA System is affected by a stored cross‑site scripting (XSS) flaw. An attacker with privileged remote access can inject persistent JavaScript that is executed in any user’s browser when the page loads. Because the payload is stored, each subsequent visit to the page triggers the malicious script, allowing the attacker to steal session data, tamper with UI, or perform other client‑side attacks.

The vulnerability impacts ITP Technology’s ITS Intelligent SCADA System. No specific version range is supplied by the vendor, so any deployed instance of the product should be examined for the presence of the flaw.

The CVSS score of 4.8 indicates a medium severity vulnerability. EPSS information is not available, and the flaw is not listed in the CISA KEV catalog. The attacker must be able to run code with privileged access to the SCADA system before the XSS can be leveraged, suggesting a local or authenticated remote attack vector. If the attacker achieves this, the stored script could be executed in the context of any user that views the affected page.