CVE-2026-11878

MediumCVSS 6.1/10Last modified Oct 25, 2026

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText Access Manager allows Cross-Site Scripting (XSS).

This issue affects Access Manager: from 5.1 through 5.1.2.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
OpenText	Access Manager	>= 5.1, <= 5.1.2

References

https://portal.microfocus.com/s/article/KM000047449Vendor Advisory

Timeline

Published: Jun 24, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1187803.7Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementa CVE-2026-1187815.3Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementa CVE-2026-1187827.5Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge accepted a P CVE-2026-1187836.8The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting CVE-2026-1187846.4The WPSpeed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.10 This is due to a comb CVE-2026-1187856.7Improper handling of non-secure-world input in NSC veneer functions of NXP MCUXpresso SDK TrustZone-M examples (trustzone_examples), affecti CVE-2026-1187866.8Improper input validation in non-secure-callable (NSC) veneer functions of the NXP MCUXpresso SDK rpmsg-lite multicore example (multicore_ex CVE-2026-118798.5MobaXterm Personal Edition (Portable), in its 26.3 version (Build 5154), allows arbitrary code execution by loading malicious DLLs from a te CVE-2026-1187907.2Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unaut CVE-2026-1187917.2The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to CVE-2026-1187926.1Default credentials permit access through AcuXDBC.CVE-2026-1187955.9Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with da