CVE-2026-113465

MediumCVSS 6.6/10Last modified Oct 20, 2026

Description

It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel.

To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into visiting that link.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 20, 2026
Last modified: Oct 20, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1134665.3A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/S CVE-2026-1134686.9The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visit CVE-2026-1134697.5A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine r CVE-2026-113478.5The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charse CVE-2026-1134705.4Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Fi CVE-2026-1134725.4The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload end CVE-2026-113488.1Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows Fake the Source of Data. This issue affect CVE-2026-1134894.3The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing CVE-2026-113498.6The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and CVE-2026-1134905.3The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup throug CVE-2026-1134916.4The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when savi CVE-2026-1134925.3The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its