CVE-2026-48413

HighCVSS 8.7/10Last modified Sep 25, 2026

Description

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Aug 11, 2026
Last modified
Sep 25, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-484148.7Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject CVE-2026-484158.3Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attaCVE-2026-484167.5Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could levCVE-2026-484177.8Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the contexCVE-2026-484187.8Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of thCVE-2026-484197.8Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of thCVE-2026-48427.3A security vulnerability has been detected in itsourcecode Online Enrollment System 1.0. This vulnerability affects unknown code of the fileCVE-2026-484207.8Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of thCVE-2026-484217.8Substance3D - Sampler is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of thCVE-2026-484227.8Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the contextCVE-2026-484237.8Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the contextCVE-2026-484247.8Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context
CVE-2026-48413: High severity, CVSS 8.7 | Vulnix