The vulnerability is an Improper Neutralization of Input During Web Page Generation flaw that permits stored cross‑site scripting (XSS). Attackers can insert malicious code into user‑controlled fields; the code is subsequently saved and rendered within the web application when other users view the affected content, causing arbitrary JavaScript to execute in those users’ browsers.

Xerox CentreWare Web on Microsoft Windows operating systems is affected in all releases up to and including version 7.0.6. Any deployment of these versions that exposes the vulnerable web pages is susceptible.

The CVSS score of 5.3 indicates a moderate impact, while the EPSS of less than 1 % points to a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely via the web interface where user input is stored; no explicit authentication or privilege prerequisites are stated, so exploitation could be possible from any user who can submit data to the vulnerable page.