Authenticated phishing via synced Smart Polling HTML

Stored HTML injection in Nozomi Networks Guardian and CMC before 26.1.0 allows remote authenticated users to render HTML in a victim's browser. The Smart Polling sync accepts HTML tags in a malicious remote strategy and later inserts that strategy into the viewing interface without sufficient validation. Limited privileges suffice to plant the strategy, but a victim must view it; the rendered HTML enables phishing while existing validation and CSP block full XSS and direct disclosure.