CVE-2026-113808

HighCVSS 7.1/10Last modified Oct 20, 2026

Description

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.

Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 20, 2026
Last modified: Oct 20, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-113818.8IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation o CVE-2026-1138107.0A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS CVE-2026-1138117.5Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search CVE-2026-1138129.1Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bu CVE-2026-1138136.5The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthen CVE-2026-1138148.8Untrusted pointer dereference in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over a network.CVE-2026-1138154.7Improper control of generation of code ('code injection') in Windows PowerShell allows an authorized attacker to bypass a security feature l CVE-2026-1138164.1Integer overflow or wraparound in Windows Link-Layer Discovery Protocol (LLDP) allows an authorized attacker to elevate privileges locally.CVE-2026-1138176.6Heap-based buffer overflow in Windows Devices Human Interface allows an authorized attacker to elevate privileges with a physical attack.CVE-2026-1138186.5Relative path traversal in Windows Deployment Services allows an authorized attacker to disclose information over a network.CVE-2026-1138197.0Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.CVE-2026-1138207.0Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.