CVE-2022-26961

Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui/backup_restore.jsp and NP_IBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the name parameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will then be triggered every time an authenticated user browses the page containing it.

• CWE-79

• https://www.gruppotim.it/it/footer/red-team/2022/CVE-2022-26961-Italtel-NETMATCH-S-CLOUD-INSIDE-VNF.html

Published

Sep 4, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-26952Digi Passport Firmware through 1.5.1,1 is affected by a buff…7.5
• CVE-2022-26953Digi Passport Firmware through 1.5.1,1 is affected by a buff…7.5
• CVE-2022-26954Multiple open redirect vulnerabilities in NopCommerce 4.10 t…6.1
• CVE-2022-26959There are two full (read/write) Blind/Time-based SQL injecti…9.8
• CVE-2022-2696The Restaurant Menu – Food Ordering System – Table Reservati…6.5
• CVE-2022-26960connector.minimal.php in std42 elFinder through 2.1.60 is af…9.1
• CVE-2022-26962Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under…5.4
• CVE-2022-26964Weak password derivation for export in Devolutions Remote De…7.5
• CVE-2022-26965In Pluck 4.7.16, an admin user can use the theme upload func…7.2
• CVE-2022-26966An issue was discovered in the Linux kernel before 5.16.12. …5.5
• CVE-2022-26967GPAC 2.0 allows a heap-based buffer overflow in gf_base64_en…7.8
• CVE-2022-26969In Directus before 9.7.0, the default settings of CORS_ORIGI…9.8