CVE-2026-7175CWE-79cross-site-scripting
CVE-2026-7175
published October 1, 2026
What it is
CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;
The record
Technical detail
- CVSS
- 4.8 · NONE
- CVSS v4.0
- 4.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- EPSS
- 0.00234 · 13.5th percentile
- Weakness
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2026-10-01T14:17Z
References (1)
EPSS history
Timeline