The vulnerability is an HTML injection flaw caused by insufficient validation of user input in the HCL Sametime web application. An attacker can embed malicious HTML fragments that, when rendered by a victim’s browser, automatically load external resources such as images or scripts. These external requests can cause the browser to leak sensitive data to an attacker‑controlled server, resulting in potential data exfiltration. The weakness is categorized as CWE‑79, indicating an injection vulnerability that allows unintended content to be rendered on a web page.

Affected systems include the HCL Sametime platform referenced in the CVE description. No specific version numbers are provided in the CNA data, so the vulnerability may affect all versions that exhibit the described input‑validation issue until a patch is released. Organizations should review their deployment to determine whether the affected components are in use.

The CVSS score of 4.7 places the vulnerability in the moderate range, and the lack of an EPSS score and absence from the KEV catalog suggest it is not a widely known or exploited issue at present. Exploitation requires a victim to load a page containing the injected HTML, implying a client‑side attack vector that can be performed by a user visiting a compromised site or by social engineering. Therefore, the risk is moderate, primarily limited to users who interact with the vulnerable web pages.