A vulnerability exists in Progress Flowmon versions prior to 12.5.8 and 13.0.6 that allows an administrator who clicks a malicious link to inadvertently trigger unintended actions within their authenticated web session. This can grant the attacker unauthorized operations as the admin user, leading to potential compromise of the system. The weakness is classified as a cross‑site scripting flaw (CWE‑79).

The affected product is Progress Software Flowmon. Versions before 12.5.8 and 13.0.6 are impacted. No additional product or version details are provided.

The CVSS score of 8.5 indicates a high severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a phishing or social‑engineering scenario where an authenticated administrator clicks a malicious link; the exploitation is conditioned on the presence of an admin session. While the vulnerability is serious, the attacker must obtain or coerce an admin to act, which reduces the likelihood compared to purely remote exploits, but the consequences remain significant if successful.