This vulnerability affects Radware Cyber Controller versions 10.0 through 10.11.0. It arises from improper handling of input in the HTML Report Generation component, leading to HTML injection that enables basic cross-site scripting attacks. The vulnerability can be exploited remotely without requiring privileges, but user interaction is needed. Although publicly disclosed, there is no known official fix or vendor advisory at this time.

Successful exploitation could allow an attacker to inject malicious HTML or scripts into reports generated by the affected component, potentially leading to cross-site scripting attacks. This may result in the execution of arbitrary scripts in the context of the victim's browser, which could be used to steal session tokens or perform actions on behalf of the user. However, the CVSS score of 5.1 indicates a medium impact, and exploitation requires user interaction and limited privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or vendor response is available, users should monitor Radware's communications for updates. In the meantime, consider restricting access to the affected component and applying any available workarounds or input validation controls to mitigate risk.