SEPTEMBER 30, 2026
Live Feed
Back to database
Case File

CVE-2026-40544

UNKNOWN · CVSS N/A EPSS 0.29%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2026-06-01 · Last synced 2026-08-04

CyberRota Analysis

This vulnerability has an unknown severity rating. It affects Java. Exploitation may require the attacker to be authenticated.

CVE
CVE-2026-40544
Severity
UNKNOWN
CVSS
N/A
EPSS
0.29%
Java

Original NVD Description

SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a malicious user.csv file with embedded JavaScript. The injected code is executed in the victim’s browser when a user clicks the Edit button for the malicious backup. This issue affects SOPlanning version 1.55 and below.