CVE-2026-25558

MediumCVSS 4.8/10Last modified Jul 23, 2026

Description

QloApps through 1.7.0 contains a stored cross-site scripting vulnerability in the admin file manager that allows authenticated administrators to inject malicious JavaScript by uploading crafted SVG files. Attackers can embed JavaScript event handlers such as onload within SVG files uploaded through the file manager to execute arbitrary scripts in the browser of any user who subsequently views the file.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 8, 2026
Last modified
Jul 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-255598.8OpenBullet2 through version 0.3.2 contains a path traversal vulnerability in the wordlist endpoint that allows authenticated attackers to peCVE-2026-25566.3A security vulnerability has been detected in cskefu up to 8.0.1. This issue affects some unknown processing of the file com/cskefu/cc/contrCVE-2026-255609.8WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied username input is incorporCVE-2026-255617.5WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API. The API does not fully validate that provided iCVE-2026-255624.3WeKan versions prior to 8.19 contain an information disclosure vulnerability in the attachments publication. Attachment metadata can be retuCVE-2026-255637.5WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implCVE-2026-255647.5WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implCVE-2026-255656.5WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rathCVE-2026-255665.4WeKan versions prior to 8.19 contain an authorization vulnerability in card move logic. A user can specify a destination board/list/swimlaneCVE-2026-255674.3WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation API. The endpoint accepts an auCVE-2026-255684.3WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sCVE-2026-255697.8A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). An out-of-bounds write vulnerability exists in SICAM SIAPP S
CVE-2026-25558: Medium severity, CVSS 4.8 | Vulnix