CVE-2026-122095

HighCVSS 7.6/10Last modified Nov 11, 2026

Description

AsiaInfo BSS Platform 9.2 before 9.2.38 has a stored cross-site scripting (XSS) vulnerability in the menu icon upload function. An authenticated user with ordinary application privileges can upload an SVG file containing embedded JavaScript, which is served from the application origin. Normal menu rendering uses an HTML <img> element and does not execute the SVG script; exploitation requires a victim to load the uploaded SVG as a document (by directly navigating to its URL, or via <object>/<iframe>), in which case the script executes under the application origin.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 11, 2026
Last modified: Nov 11, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-122096Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches Java. Several deserializers trusted CVE-2026-1220976.5CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. CVE-2026-1220985.1CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An a CVE-2026-1220992.9CAI Content Credentials is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker CVE-2026-12219.8PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated r CVE-2026-122106.3A vulnerability was detected in universal-tool-calling-protocol python-utcp 1.1.0. This affects an unknown function of the component utcp-gq CVE-2026-1221005.5CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security fea CVE-2026-1221013.7CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacke CVE-2026-1221028.7Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject m CVE-2026-122112.7A flaw has been found in Intelbras iNVU 7016 FT 3.004.00IB000.0.T Build 2025-09-26. This impacts an unknown function of the file /RPC2_Loadf CVE-2026-1221134.3A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a physically present attacker using a maliciously crafted USB device to tr CVE-2026-1221164.3Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configu