CVE-2026-8166

MediumCVSS 5.4/10Last modified Oct 24, 2026

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing Portal allows Stored XSS.

This issue affects e-Logo Purchasing Portal: before 1.52.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
Logo Software Industry and Trade Inc.e-Logo Purchasing Portal< 1.52

References

Timeline

Published
Aug 6, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-816608.8The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to sCVE-2026-816628.6Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration valuCVE-2026-816645.3The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each administrative /system/*CVE-2026-816657.5A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast CVE-2026-816666.5An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages canCVE-2026-816685.4A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View FilteCVE-2026-816697.2IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the create csr wildcard CLI command. An authenticateCVE-2026-81676.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in THEWP Digital Solutions News Theme V8 CVE-2026-816729.3SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the id_video parameter. The applicaCVE-2026-816739.3The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. The application does nCVE-2026-816749.3The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id_ambito parameter. Unsanitized input is directly incoCVE-2026-816759.3The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the id_seccion parameter. The parameter is di
CVE-2026-8166: Medium severity, CVSS 5.4 | Vulnix