CVE-2026-11903

MediumCVSS 5.4/10Last modified Jul 10, 2026

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module).

This issue affects MOVEit Transfer: from 2026.0.0 before 2026.0.1, from 2025.1.0 before 2025.1.4, from 2025.0.0 before 2025.0.8.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 8, 2026
Last modified
Jul 10, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-119045.3IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access ContainerCVE-2026-119054.3The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all veCVE-2026-119066.5IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticaCVE-2026-119076.5The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the pluginCVE-2026-119085.4Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Stored XSS. This CVE-2026-119093.3Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers vCVE-2026-11914.4The JavaScript Notifier plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin settings in all versions up to, and incCVE-2026-119117.5The Simple File List plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the eeSFL_DelCVE-2026-119127.5The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versiCVE-2026-119139.8vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.CVE-2026-119145.9vulnerability in Drupal Composer allows . This issue affects Composer versions: *.*.CVE-2026-119155.9vulnerability in Drupal Brute force attack protection allows . This issue affects Brute force attack protection versions: *.*.
CVE-2026-11903: Medium severity, CVSS 5.4 | Vulnix