This vulnerability exists in DataGear up to version 5.0.0 in the HtmlTplDashboardWidgetHtmlRenderer.java file, specifically in the Chart Name Handler component. The flaw arises from improper handling of the Title argument, allowing an attacker to inject malicious scripts that execute in the context of a victim's browser (cross-site scripting). Remote exploitation is possible without requiring user interaction beyond triggering the vulnerable functionality. Public exploit details are available, but no official remediation or patch has been provided by the vendor.

Successful exploitation of this vulnerability allows an attacker to perform cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of the affected user's browser. This can result in session hijacking, defacement, or other malicious actions depending on the victim's privileges and the application's context. However, the CVSS score and vector indicate that the impact is limited to low integrity and no confidentiality or availability impact is expected.

No official fix or patch is currently available from the vendor, and the vendor has not responded to the disclosure. Users should consider implementing application-level mitigations such as input validation and output encoding for the Title parameter to prevent script injection. Monitoring for suspicious activity related to this vulnerability is advisable until an official patch is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.