Security Advisory

CVE-2026-91922

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-15 11:00:50

Last updated 2026-09-15 12:40:04

Assigner VulnCheck

CVSS score 6.1

State PUBLISHED

Description

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaApi or data parameters to execute arbitrary JavaScript in victim sessions and steal X-Auth-Token credentials.

← Browse all CVEs View on cve.org ↗