Dell Unisphere for PowerMax vApp versions 9.2.4.x contain an Improper Neutralization of Input During Web Page Generation vulnerability that allows a low‑privileged, remote attacker to inject malicious HTML or JavaScript into the application’s output. The injected code executes in the victim’s web browser, potentially leading to information disclosure, session theft, or client‑side request forgery.

The affected product is Dell Unisphere for PowerMax vApp, specifically version 9.2.4.x. Clients with remote web access and low privileges are at risk, as the vulnerability is triggered through the web interface.

The CVSS score of 5.4 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote access to the Unisphere web application and a low‑privileged attacker; the flaw is client‑side, meaning that mitigation relies primarily on patching or disabling the vulnerable functionality.