The flaw lies in the addclient3 webpage of Quest NetVault Backup; an attacker can inject arbitrary script through lack of input validation, which enables cross‑site scripting (CWE‑79). The vulnerability also allows bypassing authentication when a user visits a malicious page or opens a malicious file. In combination with other weaknesses, the attacker may execute code in the context of SYSTEM.

Quest NetVault Backup is affected; affected versions are not specified in the advisory.

The CVSS score of 8.8 indicates a high severity vulnerability. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, but the requirement for user interaction means that exploitation depends on phishing or social engineering. The authentication bypass combined with XSS raises the risk of privilege escalation and remote code execution for attackers who can compromise the target environment.