CVE-2026-87752

MediumCVSS 6.1/10Last modified Sep 28, 2026

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows XSS Targeting HTML Attributes.

This issue affects Agentis: from 4.44 before 4.6.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
Rolantis Information Technologies Tourism Industry and Trade Co. Ltd.Agentis>= 4.44, < 4.6

References

Timeline

Published
Sep 28, 2026
Last modified
Sep 28, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-87755Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB CVE-2026-87756The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran wiCVE-2026-87758The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able CVE-2026-877598.8The Add User Autocomplete WordPress plugin before 1.2 does not perform any capability or nonce check before creating a pending site-membershCVE-2026-87768.8A vulnerability has been found in Edimax BR-6428NS 1.10. This vulnerability affects the function formPPTPSetup of the file /goform/formPPTPSCVE-2026-877608.8The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visCVE-2026-877618.0The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticCVE-2026-877628.8The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, anCVE-2026-877648.8The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is CVE-2026-877655.5In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of CVE-2026-877668.8A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the CVE-2026-877678.6The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQ
CVE-2026-87752: Medium severity, CVSS 6.1 | Vulnix