A cross‑site scripting flaw exists in OpenNebula v6.10.0.1 that allows an attacker to inject arbitrary HTML or JavaScript through the zone attribute parameter in the web console. The vulnerability stems from insufficient input validation and sanitization for this field, enabling the execution of client‑side code within the victim’s browser. This can lead to session hijacking, defacement, or the delivery of additional malicious payloads and represents a classic Cross‑Site Scripting scenario.

The issue affects OpenNebula installations running the 6.10.0.1 release. Any environment that exposes the web console to untrusted users or networks is at risk. No other vendor products are listed and no additional versions are known to be impacted by the data provided.

The CVSS score for this vulnerability is 6.1; the EPSS score is 0.00029, indicating a very low exploitation probability. Public exploitation code can be found on a community GitHub repository, indicating a low‑barrier attack path. Attackers can reach the vulnerable parameter via normal web requests to the console, so both unauthenticated and authenticated access that can manipulate the zone field constitutes a valid attack vector. While the flaw is client‑side, the potential for persistent or credential‑stealing attacks underscores a medium severity impact for exposed deployments.