This vulnerability affects DataGear up to version 5.0.0 in the HtmlTplDashboardWidgetHtmlRenderer.java file within the Chart Name Handler component. The vulnerability arises from improper handling of the Title argument, allowing an attacker to inject malicious scripts (cross-site scripting). The flaw can be triggered remotely without requiring privileges, though user interaction is needed. The exploit has been publicly disclosed, but no official patch or remediation guidance has been provided by the vendor.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. However, the CVSS score and vector indicate that the impact is limited to low integrity and requires user interaction, reducing the overall risk severity to medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider applying application-level input validation or sanitization as a temporary mitigation. Monitoring for updates from the vendor is recommended.