CVE-2026-121578

MediumCVSS 6.1/10Last modified Nov 3, 2026

Description

Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading to account takeover or code execution.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 3, 2026
Last modified: Nov 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1215796.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements CVE-2026-121588.8The RegistrationMagic – User Registration Forms Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up t CVE-2026-1215808.1Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-pr CVE-2026-1215814.3A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. The impacted element is an unknown function of the file /api/v1/providers/{i CVE-2026-1215826.5A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the componen CVE-2026-1215836.3A vulnerability was identified in Sanluan PublicCMS 5. This affects the function TradePaymentService.pendingRefund of the file publiccms-par CVE-2026-1215854.3A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engi CVE-2026-1215875.3Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names a CVE-2026-1215886.1TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying CVE-2026-1215895.3A weakness has been identified in spatie url-signer up to 2.1.3. Affected is the function AbstractUrlSigner::validate of the file AbstractUr CVE-2026-1215979.9A weakness has been identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setAppEasyWizardConfig of the file /cgi-CVE-2026-1215989.9A security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function strcpy of the file /cgi-bin/