The vulnerability lies in the improper neutralization of input during web page generation, allowing attackers to store malicious scripts that are executed in the browser of any user viewing affected pages. This form of cross‑site scripting can lead to session hijacking, credential theft, or malicious defacement of the user interface. The impact is limited to the victim’s browser session, but it can compromise confidential data accessed in that session.

The issue affects TMT Machinery Industry and Trade Co. Ltd.’s Talassoft Industrial Management Software, specifically all releases prior to version V16.0.1.

The CVSS score of 5.4 indicates a moderate level of severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web application interface where users can submit input that is subsequently stored and rendered without proper encoding. Attackers would need the ability to submit or modify data that is persisted by the application; they can then exploit the stored script when other users view the affected content.