CVE-2026-123766

— UNSCOREDpublic exploit available

Published 2026-11-09 · Updated 2026-11-09

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding, allowing script injection in the context of the Axis2 origin. This issue affects Apache Axis2/Java: 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

Weaknesses

CWE-79

Public exploit & PoC references

https://github.com/apache/axis-axis2-java-core/commit/1671a68660df39459bf22f7b00309e2a8e782117

All references

https://axis.apache.org/axis2/java/core/release-notes/2.0.2.html
https://github.com/apache/axis-axis2-java-core/commit/1671a68660df39459bf22f7b00309e2a8e782117
https://lists.apache.org/thread.html/gzxdd4gobm1kb0jdonmn4n8xhjkwlrbg
http://www.openwall.com/lists/oss-security/2026/11/06/24

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2012-20003PoC
MEDIUMCVE-2012-20004PoC
MEDIUMCVE-2012-20005PoC
MEDIUMCVE-2013-20009PoC
MEDIUMCVE-2014-125131PoC
MEDIUMCVE-2014-125132PoC
MEDIUMCVE-2015-20130PoC
MEDIUMCVE-2016-20098PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.