A stored cross‑site scripting flaw resides in the user documentation field of ANOW! Automate v3.3.1.90. A malicious actor can inject script code that is subsequently rendered when any user views the documentation, allowing the attacker to run arbitrary code in the victim’s browser and potentially steal session cookies, read sensitive data, or perform other client‑side attacks that effectively amount to remote code execution.

The vulnerability affects Beta Systems Software AG ANOW! Automate version 3.3.1.90. Any deployment that includes this version and exposes the user documentation input field to external users is susceptible. No earlier or later versions are listed as affected.

The CVSS score is 6.1, indicating a medium severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, so a precise risk quantification cannot be derived from the available data. Based on the description, the attack would involve a remote attacker submitting a crafted payload into the user documentation field, which, once stored, causes the browser to execute the malicious code whenever the documentation page is loaded. Because the flaw is a cross‑site scripting bug that grants arbitrary client‑side code execution, the potential damage includes credential theft, defacement, and further exploitation of downstream systems. The lack of formal scoring suggests the severity may not have been assessed, but the impact of arbitrary code execution in a web application context warrants urgent attention.