This vulnerability involves a cross-site scripting (XSS) issue in OpenNebula v6.10.0.1, where an attacker can inject malicious scripts or HTML through the zone attribute parameter. The vulnerability is publicly disclosed but lacks a CVSS score and official remediation details. It does not affect cloud-hosted services and no known exploits have been reported.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser session when interacting with the vulnerable parameter. This may lead to session hijacking, defacement, or other client-side attacks depending on the victim's interaction with the affected interface. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying input validation or output encoding on the zone attribute parameter as a temporary mitigation. Monitor vendor communications for updates on patches or official workarounds.