CVE-2026-92418

LowCVSS 3.5/10Last modified Sep 17, 2026

Description

A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects unknown code of the file src/main/resources/public/js/customerServe/customer.serve.js of the component Save Endpoint. This manipulation of the argument customerName causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

VendorProductVersions
ChangeWeDercrmc07bd4c97141521af6475034bc58523beed51bbd

References

Timeline

Published
Sep 16, 2026
Last modified
Sep 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-924195.3WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/vacations/{path} endpoint. The selectedPeople parameter in tCVE-2026-92425.3The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to AuthentiCVE-2026-924203.8The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the reCVE-2026-924214.7The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modifCVE-2026-924226.5The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode strCVE-2026-924232.7The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own pCVE-2026-924246.8The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the imCVE-2026-924255.5The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checCVE-2026-924264.9The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, alCVE-2026-924275.3The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gatCVE-2026-924285.3The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating anCVE-2026-924295.3The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an
CVE-2026-92418: Low severity, CVSS 3.5 | Vulnix