CVE-2026-8474

MediumCVSS 5.3/10Last modified Jul 22, 2026

Description

A vulnerability was discovered on Stormshield Network Security

* 4.3.0 to 4.3.41, * 4.8.0 to 4.8.15, * 5.0.0 to 5.0.5

It is possible to execute a reflected XSS attack on the login API available on Stormshield SNS appliance by executing a script on the victim's machine. The risks include the theft of cookies or other sensitive data, as well as the modification of page behavior, for example, by redirecting the victim to malicious websites.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 1, 2026
Last modified: Jul 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-847406.5The Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before m CVE-2026-847415.3The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details in CVE-2026-847422.7The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it CVE-2026-847433.8The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, al CVE-2026-847446.5The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them CVE-2026-847452.7The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public RES CVE-2026-84747Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to by CVE-2026-84748Improper authorization in Apache bRPC (versions < 1.18.0) on all platforms allows remote attackers to access builtin services through the pu CVE-2026-847506.5The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of CVE-2026-847528.8Contributor PHP Object Injection in RTMKit <= 2.1.5 versions.CVE-2026-847539.8Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.CVE-2026-847546.5Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.