The vulnerability originates from improper neutralization of input during web page generation in the OpenText Vertica management console. According to the vendor description, it permits reflected cross‑site scripting (XSS) where an attacker can inject malicious scripts into a response that is returned to a victim’s browser. This could lead to session hijacking, data theft, or unauthorized actions performed in the context of the authenticated user.

Affected products are OpenText Vertica versions from 10.0 through 10.X, 11.0 through 11.X, 12.0 through 12.X, 23.0 through 23.X, 24.0 through 24.X, and 25.1.0 through 25.1.X.

The CVSS score of 5.1 indicates moderate risk, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would occur via the management console’s web interface and requires a victim to visit a crafted link or execute code within the console, implying user interaction is necessary. The lack of remote code execution and the requirement for authentication or access to the console limit the overall threat surface, but the impact remains significant for exposed management interfaces.