CVE-2026-71189CWE-79cross-site-scripting

CVE-2026-71189

Low · published September 30, 2026

CVSS v3.1
3.5
EPSS
0%
Percentile
7.8
In the wild
Unconfirmed
What it is

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
4.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00186 · 7.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-30T02:18Z
References (3)
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json · [email protected]https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02 · [email protected]https://www.toptech.com/blog/tms7-version-7-8-strengthens-security · [email protected]
EPSS history
Timeline
  • 01 OCT 03:49Z
    EPSS moved — → 0%
    epss
  • 29 SEP 21:46Z
    Toptech TMS7 and TopHAT Cross-site Scripting
    cvelistv5