A flaw in Progress Flowmon ADS allows maliciously crafted network data to be processed by the application and, when viewed by an authenticated user, can trigger unintended actions within the user's browser context. The vulnerability is a form of client‑side code injection, relating to the CWE‑79 (XSS) weakness reported by the vendor.

The issue affects Progress Software Flowmon ADS versions prior to 12.5.5 and 13.0.3. Any deployed instance using those versions is susceptible; newer releases contain the fix.

The CVSS score of 8.6 indicates high severity. EPSS is listed as <1%, implying a low but non‑zero probability of exploitation in the wild, and the vulnerability is not catalogued in CISA's KEV. An attacker must have access to the Flowmon monitoring ports to craft the malicious payload, and the victim must be an authenticated user who opens the affected data in a web browser. Although the exploitation vector is relatively narrow, the impact is significant due to the potential for arbitrary JavaScript execution in the user's context.