CVE-2026-7380

MediumCVSS 6.1/10Last modified Jul 7, 2026

Description

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows XSS Targeting HTML Attributes.

This issue affects Access Control System (GKS): before Version 2.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-80

Affected software

No affected versions have been published.

Timeline

Published: Jul 7, 2026
Last modified: Jul 7, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-738008.8Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target ev CVE-2026-738028.8Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled. Host na CVE-2026-738048.1Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests sign CVE-2026-738079.8The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with ne CVE-2026-738097.5A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does CVE-2026-73819.1Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting. Plack::Middleware::XSendfile allo CVE-2026-738128.3httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 CVE-2026-738146.5Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. Th CVE-2026-738199.8The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's ide CVE-2026-73826.5Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal information to an unauthorized actor vulnerability CVE-2026-738274.8SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is loggin CVE-2026-738293.7Time-of-check Time-of-use (TOCTOU) Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain pa