Karel Electronics' ViPort product contains a stored cross‑site scripting flaw that allows an attacker to embed malicious scripts into the application’s output. When a victim later views the affected page, the browser executes the injected code as if it originated from the trusted site, potentially compromising session cookies, defacing content, or redirecting users to phishing sites. The vulnerability is a classic example of Improper Neutralization of Input During Web Page Generation (CWE‑79).

All installations of Karel Electronics Industry and Trade Inc.’s ViPort running versions up to and including 23012026 are affected. No other versions are listed as vulnerable.

The flaw has a CVSS score of 8.8, indicating a high severity. EPSS is below 1 %, suggesting a currently low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be through the web interface where user input is accepted and stored; an attacker would need to submit malicious content that the application later renders. No specific authentication or privilege escalation steps are mentioned, so the vulnerability may be exploitable by users who can create or modify content in the system.