CVE-2026-26464
Last modified
CVE-2026-26464 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Stored Cross-Site Scripting (XSS) was found in the /admin/edit_user.php page of Society Management System Portal V1.0, which allows remote attackers to inject and store arbitrary JavaScript code that is executed in users' browsers. This vulnerability can be exploited via the name parameter in a POST HTTP request, leading to execution of malicious scripts when the affected content is viewed by other users, including administrators.. EPSS estimates a 0.25% chance of exploitation in the next 30 days.
Description
Stored Cross-Site Scripting (XSS) was found in the /admin/edit_user.php page of Society Management System Portal V1.0, which allows remote attackers to inject and store arbitrary JavaScript code that is executed in users' browsers. This vulnerability can be exploited via the name parameter in a POST HTTP request, leading to execution of malicious scripts when the affected content is viewed by other users, including administrators.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Kashipara | Society Management System Portal | 1.0 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2026-26464?
How severe is CVE-2026-26464?
How do I fix CVE-2026-26464?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-2644A weakness has been identified in niklasso minisat up to 2.2…7.8
- CVE-2026-2645In wolfSSL 5.8.2 and earlier, a logic flaw existed in the TL…7.5
- CVE-2026-2646A heap-buffer-overflow vulnerability exists in wolfSSL's wol…8.1
- CVE-2026-26460A HTML Injection vulnerability exists in the Dashboard modul…6.1
- CVE-2026-26461A Command Injection vulnerability in the web management inte…6.5
- CVE-2026-26462Offline Hospital Management System 5.3.0 allows remote code …7.3
- CVE-2026-2647Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-26477An issue in Dokuwiki v.2025-05-14b "Librarian" [56.2] allows…4.3
- CVE-2026-26478A shell command injection vulnerability in Mobvoi Tichome Mi…9.8
- CVE-2026-2648Heap buffer overflow in PDFium in Google Chrome prior to 145…8.8
- CVE-2026-26483Mettle SendPortal 3.0.1 and earlier contains a stored cross-…6.1
- CVE-2026-2649Integer overflow in V8 in Google Chrome prior to 145.0.7632.…8.8
Are you affected by CVE-2026-26464?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST