CVE-2026-4103

MediumCVSS 6.4/10Last modified Sep 18, 2026

Description

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed.

Successful exploitation may result in the execution of malicious scripts within the user's browser context when viewing API documentation. Users with permissions to access the API documentation through these portals may be impacted, potentially allowing attackers to perform actions on behalf of the user, depending on their session privileges.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 14, 2026
Last modified: Sep 18, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-410306.2In ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform actions on files with SYSTEM privileges.CVE-2026-410318.7A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Build 63255) allows an authenticated remote CVE-2026-410327.5It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted informat CVE-2026-410345.0ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and oth CVE-2026-410357.8In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. T CVE-2026-410368.8This vulnerability exists in Quantum Networks router due to inadequate sanitization of user-supplied input in the management CLI interface. CVE-2026-410378.8This vulnerability exists in Quantum Networks router due to missing rate limiting and CAPTCHA protection for failed login attempts in the we CVE-2026-410388.8This vulnerability exists in Quantum Networks router due to lack of enforcement of strong password policies in the web-based management inte CVE-2026-410397.5This vulnerability exists in Quantum Networks router due to improper access control and insecure default configuration in the web-based mana CVE-2026-41049.8Authorization bypass through User-Controlled SQL primary key vulnerability in Akmer Informatics Automation Industry and Trade Ltd. Co. Tekno CVE-2026-410408.7GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string.CVE-2026-410419.1URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0