This flaw allows an attacker to inject malicious script into a page that is subsequently served to a victim’s browser, enabling data theft, session hijacking, or defacement. The improper neutralization of user input during page generation creates a reflected XSS condition that can be triggered through crafted URLs or form fields. The impact is confined to the browser context but any attacker who succeeds can exfiltrate cookies, identity data, or inject further malware. Based on the description, it is inferred that the attack requires a victim to click a malicious link or submit crafted data to trigger the XSS.

OpenText Access Manager versions 5.1 through 5.1.2 are vulnerable. No other products or versions are listed as affected.

The CVSS score of 8.2 indicates a high‑severity flaw, though its EPSS score is not available and it is not listed in the CISA KEV catalog. The vulnerability is a client‑side issue that requires a victim to click a crafted link or submit data, so it is remotely exploitable with user interaction. Based on the description, it is inferred that the vulnerability requires victim interaction to be exploited.