CVE-2026-28263

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain a cross-site Scripting vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 17, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-282645.5Dell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerabilityCVE-2026-282657.1PowerStore, contains a Path Traversal vulnerability in the Service user. A low privileged attacker with local access could potentially exploCVE-2026-282676.8Multiple i-フィルター products are configured with improper file access permission settings. Files may be created or overwritten in the system diCVE-2026-282689.8Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the paCVE-2026-282698.8Kiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks command execution functionality allows authenCVE-2026-28274.7The Open User Map PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'oum_location_notification' parameter in verCVE-2026-282707.2Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows uploading of arbitrary CVE-2026-282716.5Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration functionality allows bypassingCVE-2026-282724.8Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks Email Protection Gateway allows authenticateCVE-2026-282748.7Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 are vulnerable to Stored Cross-Site ScrCVE-2026-282758.1Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 do not invalidate previously issued JWTCVE-2026-282767.5Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where