CVE-2025-40900— Angular template injection in Reports in Guardian/CMC before 26.1.0

Angular template injection in Reports in Guardian/CMC before 26.1.0

An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing an Angular template payload, or a victim can be socially engineered to import a malicious report template. When the victim views or imports the report, the Angular template executes in their browser context, allowing the attacker to modify application data, or disrupt application availability. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

CWE-1336

Nozomi Networks CMC和Nozomi Networks Guardian 安全漏洞

Nozomi Networks CMC和Nozomi Networks Guardian都是美国Nozomi Networks公司的产品。Nozomi Networks CMC是一款网络管理平台。Nozomi Networks Guardian是一款防护软件。 Nozomi Networks Guardian和Nozomi Networks CMC存在安全漏洞，该漏洞源于对输入参数验证不当导致的Angular模板注入问题，允许具有报告权限的认证用户定义包含Angular模板有效载荷的恶意报告，或通过社会工

N/A

N/A