The vulnerability originates from the use of an outdated jQuery 1.x library in the HCL BigFix SCM Reporting web application. End‑of‑life support means the library no longer receives security updates, exposing the application to publicly known weaknesses that can enable client‑side attacks such as Cross‑Site Scripting. The flaw is identified as CWE‑1104 and can lead to arbitrary script execution within a user’s browser context when malicious input is rendered.

The affected product is HCL Software’s BigFix SCM Reporting web application. No specific vendor-specified version numbers are given, so any deployment that includes the bundled jQuery 1.x is considered at risk.

The CVSS score of 8.3 indicates high severity, and the EPSS score is not available while the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation yet. Based on the description, the likely attack vector is the web interface where user input is rendered; an attacker may construct a payload that is executed in the user’s browser, leveraging the outdated library. Exploitation does not require server‑side privileges but depends on the presence of injectable or user‑controlled content served by the application.