CVE-2026-9588

HighCVSS 7.0/10Last modified Oct 24, 2026

Description

A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality. The submit_modify_voicemail_template endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious JavaScript supplied through the template_text parameter to be stored server-side and subsequently rendered to other users.

Metrics

CVSS 4.0 7.0/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 17, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-95899.3Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfi CVE-2026-958975.5A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function from_npy_stack of the file dask/array/core.py o CVE-2026-95905.3Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with CVE-2026-959045.5Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally.CVE-2026-95916.9Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attack CVE-2026-95927.5SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web CVE-2026-959247.3A vulnerability has been found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewe CVE-2026-959257.3A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /CVE-2026-959267.3A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The impacted element is an unknown function of the f CVE-2026-959277.3A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /review CVE-2026-959285.5A security flaw has been discovered in recommenders-team recommenders up to 1.2.1. This impacts the function pickle.load of the file recomme CVE-2026-959296.3A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/