CVE-2026-76794

MediumCVSS 4.6/10Last modified Sep 17, 2026

Description

MongoSQL Transition Readiness Tool does not sufficiently encode database metadata before including it in generated HTML. A MongoDB user with write access can introduce crafted metadata that may cause script code to run when another user generates and opens the report, potentially exposing report contents or altering its display.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 28, 2026
Last modified: Sep 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-767957.3A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the component REST API En CVE-2026-767964.0The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate CVE-2026-767976.3The MongoSQL Transition Readiness Tool writes database and collection names into its generated CSV reports without neutralizing leading char CVE-2026-767986.3The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report with CVE-2026-767995.3A weakness has been identified in code-projects Login Registration System 1.0. This affects an unknown function of the file /loginsystem/dat CVE-2026-76804.3A weakness has been identified in jsbroks COCO Annotator up to 0.11.1. Affected is an unknown function of the file backend/webserver/api/dat CVE-2026-768006.3A flaw has been found in DeDeCMS 3. Affected by this vulnerability is an unknown functionality of the file /include/dialog/select_media_post CVE-2026-768018.8The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code CVE-2026-768024.7Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST template loading branch does not apply CVE-2026-768035.3Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not en CVE-2026-768045.5Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enf CVE-2026-768055.3Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go