CVE Watch8 oct 2026

CVE-2026-105831

EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting craf

CVSS

4.3

Medio

EPSS

0.3%

p19

KEV

—

Exploit Today

0-100

Publicado: 8 oct 2026 · Última mod.: 8 oct 2026 · CWE-79

EPSS · 30d

0.3%EPSS · 30 días0.3%

2026-10-092026-10-25

Descripción técnica

EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture public form data. The request body is stored in LeadCaptureLogRecord.data and rendered unescaped when administrators view the log record, though Content Security Policy blocks JavaScript execution.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1163966.5 MED

—

———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Amelia ameliabooking allows Stored XSS.This issue affects Amelia: from n/a through 2.4.12.6h CVE-2026-1163956.5 MED

—

———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through 1.2.0.6h CVE-2026-1147106.5 MED

—

———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through 1.3.7.6h CVE-2026-1165384.7 MED

—

———HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML.7h CVE-2026-1162176.1 MED

—

———RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/Food_Service/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menu_id and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php link whose double-quoted menu_id injects an onmouseover handler, stealing session and CSRF tokens to act as the administrator.6h CVE-2026-1162125.4 MED

—

———Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in DialogAlbumSettings.html, executing JavaScript in administrators' backend sessions.6h