CVE-2026-59076

MediumCVSS 5.1/10Last modified Nov 13, 2026

Description

Edito CMS is vulnerable to Stored Cross-Site Scripting (XSS). Due to improper input validation, an authenticated attacker can inject malicious scripts into givenName and surname parameters via the /api/auth/profile endpoint. When an administrator visits the admin changelog logs, the injected script is automatically executed, in his browser.

This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released.

Metrics

CVSS 4.0 5.1/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Edito	Edito CMS	< 5.10.2607

References

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-590775.1Edito CMS is vulnerable to Stored XSS via content parameter in Tiny editor functionality. Authenticated attacker can inject arbitrary HTML a CVE-2026-590785.1Edito CMS is vulnerable to Stored XSS in avatar upload functionality. Authenticated attacker can inject arbitrary HTML and JS into website, CVE-2026-590797.1Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality allows an attacke CVE-2026-59088.8Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a cra CVE-2026-590802.1Edito CMS sends JWT token via GET requests. This allows a local attacker with access to browser history to obtain valid JWT token and perfor CVE-2026-590818.4Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the ap CVE-2026-590827.8A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC WinCC V8.1 (All version CVE-2026-590839.1Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some CVE-2026-590849.1Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were CVE-2026-590859.1Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests. This iss CVE-2026-590867.8A vulnerability has been identified in Simcenter Femap (All versions < V2606), Simcenter Nastran (All versions < V2606). The affected applic CVE-2026-590877.8A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could expl