The ITS Intelligent SCADA System version 2.1 developed by ITP Technology contains a stored cross-site scripting vulnerability (CWE-79) that enables privileged remote attackers to inject persistent JavaScript code into web pages generated by the system. This malicious code executes in the context of users' browsers upon page load, potentially leading to unauthorized actions or data exposure within the affected system environment. The vulnerability is identified as CVE-2026-10058 with a CVSS 4.8 (medium) score. No patch or official remediation has been disclosed, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

The vulnerability allows privileged remote attackers to inject persistent JavaScript code that executes in users' browsers, which could lead to unauthorized actions or data exposure within the ITS Intelligent SCADA System environment. The impact is rated medium severity with no known exploits reported. Because the vulnerability requires privileged access and user interaction, the risk is somewhat limited but still significant for affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, users should restrict privileged access to trusted personnel and monitor for suspicious activity related to web interface usage. Avoid exposing the management interface to untrusted networks until a patch is released.