Victim-context script execution via unvalidated report input

Stored XSS in Reports in Nozomi Networks Guardian and CMC before 25.5.0 allows remote authenticated users to execute script. The report editor or template importer accepts an input parameter containing JavaScript without proper validation and stores it for execution when a report is viewed or imported. Report privileges permit direct creation; otherwise, a victim must import a malicious template, after which the script acts in that victim's browser context to alter application data, interrupt the application, or access limited sensitive information.