A reflected cross-site scripting (XSS) vulnerability exists in the web user interface of multiple versions of OpenNMS Meridian and Horizon. The flaw occurs because several web UI pages improperly handle request parameters, allowing an attacker to inject and execute arbitrary JavaScript in the context of an authenticated user's browser session. This enables the attacker to read page data and perform actions with the victim's privileges. The vulnerability is fixed by encoding affected request values and preventing client-side template evaluation on AngularJS pages. Upgrading to Meridian 2024.3.15, 2025.0.12, 2026.0.2 or Horizon 36.0.6 or newer resolves the issue. These products are intended for private network use and should not be exposed directly to the Internet.