Logo
Retour à la veille

CVE-2026-15321

Publié : 10 juillet 2026
Modifié : 10 juillet 2026
Lien officiel NVD
Score CVSS
2.4
LOW

Description détaillée

A vulnerability was found in MyEMS up to 6.4.0. The affected element is the function on_post of the file myems-api/core/svg.py of the component Admin Backend. The manipulation of the argument new_values['data'] results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used. Upgrading to version 6.5.0 is sufficient to fix this issue. The patch is identified as 4a97edfbd786c779d0322054833b21ddf54d5b06. It is suggested to upgrade the affected component. The issue report remains open even though there is an official fix for it.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Références et Patchs

https://github.com/MyEMS/myems/https://github.com/MyEMS/myems/commit/4a97edfbd786c779d0322054833b21ddf54d5b06https://github.com/MyEMS/myems/issues/412https://github.com/MyEMS/myems/releases/tag/v6.5.0https://vuldb.com/cve/CVE-2026-15321https://vuldb.com/submit/853060https://vuldb.com/vuln/377263https://vuldb.com/vuln/377263/cti

Dernières Vulnérabilités

CVE-2026-21057

Improper input validation in Samsung Pass prior to version 5.2.10.3 allows local privileged attackers to write out-of-bounds memory.

VOIR DÉTAILS

CVE-2026-21056

Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information.

VOIR DÉTAILS

CVE-2026-21055

Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands with Bixby privilege.

VOIR DÉTAILS