CVE-2026-89290

LowCVSS 3.5/10Last modified Oct 8, 2026

Description

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Stored XSS.

This issue affects eimzamip: from v1.6.4 before v1.6.7.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-80

Affected software

Vendor	Product	Versions
İzometri IT Services Domestic and Foreign Trade Co. Ltd.	eimzamip	>= v1.6.4, < v1.6.7

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1275

Timeline

Published: Oct 8, 2026
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-892929.2In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNE CVE-2026-892938.8In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions th CVE-2026-892947.5The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 CVE-2026-892957.5In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter CVE-2026-892968.6The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing u CVE-2026-892978.6The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowin CVE-2026-892984.9A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue o CVE-2026-892998.6The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing CVE-2026-893005.3The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated u CVE-2026-893017.5The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file deletion due to insufficient file path CVE-2026-893028.6The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowi CVE-2026-893036.4The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowi