Ideagen DevonWay contains a stored cross‑site scripting vulnerability that allows a remote, authenticated attacker to insert malicious JavaScript into the Reports page. When another user views the report, the injected code executes within the victim's browser context, enabling the attacker to execute arbitrary client‑side actions such as stealing session cookies, defacing the interface, or performing unauthorized operations through the victim’s privileges.

Vulnerable versions of Ideagen DevonWay are all releases prior to 2.62.4 and 2.62 LTS; these earlier releases contain the flaw until patched.

The CVSS score of 4.8 represents a low‑to‑moderate impact, and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers require valid user credentials to create the malicious payload, and the exploitation path involves submitting a crafted report that is stored and later rendered to other users. Defensive measures such as ensuring proper credential management mitigate the initial access requirement.