Autonomy Logic OpenPLC Runtime v3 contains an improper neutralization of input during web page generation; when the web interface routes programs based on an unencoded query string parameter, a malicious user can inject scripts, resulting in a cross-site scripting flaw that could allow execution of arbitrary code in the browser context or compromise user sessions.

Autonomy Logic OpenPLC Runtime v3, which has reached end‑of‑life and no longer receives updates.

The CVSS score of 5.3 indicates moderate severity, and without an EPSS score the likelihood of exploitation cannot be quantified; the vulnerability is not listed in the CISA KEV catalog, and the attack vector is through the public web interface, so a remote attacker could craft a malicious URL to trigger the flaw.