CVE-2023-26060

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Nokia NetAct before 22 FP2211. On the Working Set Manager page, users can create a Working Set with a name that has a client-side template injection payload. Input validation is missing during creation of the working set. For an external attacker, it is very difficult to exploit this, because a few dynamically created parameters such as Jsession-id, a CSRF token, and an Nxsrf token would be needed. The attack can realistically only be performed by an internal user.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Apr 24, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-260615.4An issue was discovered in Nokia NetAct before 22 FP2211. On the Scheduled Search tab under the Alarm Reports Dashboard page, users can creaCVE-2023-260627.8A mobile network solution internal fault is found in Nokia Web Element Manager before 22 R1, in which an authenticated, unprivileged user caCVE-2023-260639.8Certain Lexmark devices through 2023-02-19 access a Resource By Using an Incompatible Type.CVE-2023-260649.8Certain Lexmark devices through 2023-02-19 have an Out-of-bounds Write.CVE-2023-260659.8Certain Lexmark devices through 2023-02-19 have an Integer Overflow.CVE-2023-260669.8Certain Lexmark devices through 2023-02-19 have Improper Validation of an Array Index.CVE-2023-260678.1Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4).CVE-2023-260689.8Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4).CVE-2023-260699.8Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 3 of 4).CVE-2023-26077.2The Multiple Page Generator Plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions CVE-2023-260709.8Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 4 of 4).CVE-2023-260717.5An issue was discovered in MCUBO ICT through 10.12.4 (aka 6.0.2). An Observable Response Discrepancy can occur under the login web page. In
CVE-2023-26060: High severity, CVSS 8.8 | Vulnix