The vulnerability is a reflected cross‑site scripting flaw triggered by URL handling. An unauthenticated user can supply specially crafted input in a request URL, which the application reflects back into the browser without proper sanitization. If an attacker succeeds, the injected script runs in the victim’s browser, potentially allowing session hijacking, theft of credentials, or defacement of the web interface.

ScadaBR system implementations are affected. No specific product versions are enumerated in the data, so any deployed instance of ScadaBR that has not yet applied the vendor’s fix is at risk.

The CVSS score of 6.1 indicates a medium severity issue. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not currently known to be exploited in the wild. The attack vector is client‑side; an attacker would need to entice a user to visit a crafted link, so the risk is highest in social‑engineering or phishing scenarios. While not critical, the impact could compromise confidentiality and integrity of the victim’s session.