The CVE describes a cross‑site scripting flaw in the decryption field of the Create New Project User component within Advantech WebAccess/SCADA 8.0‑2015.08.16. A remote attacker can inject malicious script that is executed in the victim’s browser, potentially allowing the attacker to read or exfiltrate sensitive information. The vulnerability corresponds to improper input validation (CWE‑79).

Advantech WebAccess/SCADA 8.0‑2015.08.16 is the only affected version recorded. No other vendor or product information is available in the CVE data.

The likely attack vector is via the web interface, entering malicious input into the decryption field of the Create New Project User component. It is inferred that the vulnerability could be triggered without prior authentication if the component is publicly reachable. The absence of an EPSS score and the lack of listing in the CISA KEV catalog suggest that no publicly documented exploits are known, but the XSS nature poses a significant risk to exposed systems. The CVSS score of 6.1 indicates moderate severity. The risk level should be considered moderate to high until a vendor patch is applied.