CVE-2026-71189

3.5 LOWpublic exploit available

Published 2026-09-29 · Updated 2026-09-29

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weaknesses

CWE-79

Public exploit & PoC references

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json

All references

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02
https://www.toptech.com/blog/tms7-version-7-8-strengthens-security

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2025-13533PoC
MEDIUMCVE-2025-14814
LOWCVE-2025-15677
MEDIUMCVE-2025-15696
LOWCVE-2025-15698
MEDIUMCVE-2025-36147
HIGHCVE-2025-61682PoC
MEDIUMCVE-2025-71419PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.