CVE-2022-26962

Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announcementAS via the name, username, or mrfAnnouncementNameparameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will then be triggered every time an authenticated user browses the page containing it.

• CWE-79

• https://www.gruppotim.it/it/footer/red-team/2022/CVE-2022-26962-Italtel-NFV.html

Published

Sep 10, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-26953Digi Passport Firmware through 1.5.1,1 is affected by a buff…7.5
• CVE-2022-26954Multiple open redirect vulnerabilities in NopCommerce 4.10 t…6.1
• CVE-2022-26959There are two full (read/write) Blind/Time-based SQL injecti…9.8
• CVE-2022-2696The Restaurant Menu – Food Ordering System – Table Reservati…6.5
• CVE-2022-26960connector.minimal.php in std42 elFinder through 2.1.60 is af…9.1
• CVE-2022-26961Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS…5.4
• CVE-2022-26964Weak password derivation for export in Devolutions Remote De…7.5
• CVE-2022-26965In Pluck 4.7.16, an admin user can use the theme upload func…7.2
• CVE-2022-26966An issue was discovered in the Linux kernel before 5.16.12. …5.5
• CVE-2022-26967GPAC 2.0 allows a heap-based buffer overflow in gf_base64_en…7.8
• CVE-2022-26969In Directus before 9.7.0, the default settings of CORS_ORIGI…9.8
• CVE-2022-2697A vulnerability was found in SourceCodester Simple E-Learnin…7.5