CVE-2026-48999
Last modified
CVE-2026-48999 is a medium-severity vulnerability rated 5.7/10 on the CVSS scale. Attackers carefully craft malicious scripts, such as JavaScript, and inject them into target systems; when other users access pages containing such malicious content, the scripts are automatically loaded and executed in the victim's browser.Attackers can thereby steal user cookies, hijack session privileges, and tamper with page content.Since the malicious code is stored within the system, the attack scope is broad and the concealment is strong, making it frequently employed for data theft attacks.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
Attackers carefully craft malicious scripts, such as JavaScript, and inject them into target systems; when other users access pages containing such malicious content, the scripts are automatically loaded and executed in the victim's browser.Attackers can thereby steal user cookies, hijack session privileges, and tamper with page content.Since the malicious code is stored within the system, the attack scope is broad and the concealment is strong, making it frequently employed for data theft attacks.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-48999?
How severe is CVE-2026-48999?
How do I fix CVE-2026-48999?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-48990joserfc is a Python library that provides an implementation …5.3
- CVE-2026-48991XianYuLauncher is a Minecraft Java Edition launcher. In vers…5.5
- CVE-2026-48994ImageMagick is free and open-source software used for editin…5.9
- CVE-2026-48995pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a ma…7.5
- CVE-2026-48997e107 is a content management system (CMS). Versions 2.3.5 a…7.1
- CVE-2026-48998guzzlehttp/psr7 is a PSR-7 HTTP message library implementati…5.3
- CVE-2026-4900A weakness has been identified in code-projects Online Food …5.5
- CVE-2026-49000An insecure password scheme refers to vulnerabilities arisin…7
- CVE-2026-49001Cross-site request forgery (CSRF) vulnerabilities allow atta…5.3
- CVE-2026-49002Access control failure means that an application does not ef…9.1
- CVE-2026-49004The built-in PostgreSQL service on the mobile device suffers…6.5
- CVE-2026-49005The root password hash of the device can be obtained through…2.4
Are you affected by CVE-2026-48999?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST