This vulnerability (CWE-79) affects Progress Flowmon versions before 12.5.8 and 13.0.6. It involves improper neutralization of input during web page generation, enabling cross-site scripting attacks. An attacker can deliver a malicious link that an administrator must click to activate unintended actions in the admin's authenticated session. The CVSS 4.0 score is 8.5 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized actions performed within an administrator's authenticated session, potentially compromising system confidentiality, integrity, and availability. The attacker must convince an administrator to click a crafted link, which could result in session manipulation or execution of malicious scripts in the context of the admin user.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking untrusted links and implement standard protections against XSS where possible. Monitor vendor channels for updates regarding patches or official mitigations.