IBM OpenPages versions 9.1 and 9.0 with Watson contain an HTML injection vulnerability. This flaw allows a remote attacker with limited privileges to inject malicious HTML code that executes in the context of the affected web application when viewed by a user. The vulnerability has a medium severity rating with a CVSS score of 5.4.