2 lines
4.3 KiB
JSON
2 lines
4.3 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"PlanManager","vendor":"RLE NOVA","versions":[{"status":"affected","version":"all versions","versionType":"custom"}]}],"source":"cve-coordination@incibe.es"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:nova-a:planmanager:-:*:*:*:*:*:*:*","matchCriteriaId":"86A1A2F5-E1F5-4588-A055-16D203EF4F36","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[{"sourceIdentifier":"cve-coordination@incibe.es","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"Stored Cross-Site Scripting (XSS) in RLE NOVA's PlanManager. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting malicious payload through the ‘comment’ and ‘brand’ parameters in ‘/index.php’. The payload is stored by the application and subsequently displayed without proper sanitization when other users access it. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user."},{"lang":"es","value":"Cross-Site Scripting (XSS) Almacenado en el PlanManager de RLE NOVA. Esta vulnerabilidad permite a un atacante ejecutar código JavaScript en el navegador de la víctima inyectando una carga útil maliciosa a través de los parámetros 'comment' y 'brand' en '/index.PHP'. La carga útil es almacenada por la aplicación y posteriormente mostrada sin la sanitización adecuada cuando otros usuarios acceden a ella. Esta vulnerabilidad puede ser explotada para robar datos sensibles del usuario, como cookies de sesión, o para realizar acciones en nombre del usuario."}],"id":"CVE-2026-1469","lastModified":"2026-06-17T10:15:50.873","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":6.9,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cve-coordination@incibe.es","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-1469","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-01-29T15:32:00.425642Z","version":"2.0.3"}}]},"published":"2026-01-29T12:16:30.643","references":[{"source":"cve-coordination@incibe.es","tags":["Third Party Advisory"],"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-rle-novas-planmanager"}],"sourceIdentifier":"cve-coordination@incibe.es","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"cve-coordination@incibe.es","type":"Secondary"}]}
|