SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-41877

MEDIUM · CVSS 5.1 EPSS 0.25%

Source: NVD + CISA KEV + EPSS · Published 2026-07-10 · Last synced 2026-08-09

CyberRota Analysis

AI-Generated

R-SOFT DMS is susceptible to a Stored XSS vulnerability in its file upload feature, allowing authenticated attackers to inject malicious HTML and JavaScript into file names. This code executes when other users access the file list or upload status, potentially compromising their sessions or data. Organizations using affected versions should prioritize patching to versions v3.19-2832 or v3.17-2580 to mitigate this risk.

CVE
CVE-2026-41877
Severity
MEDIUM
CVSS
5.1
EPSS
0.25%

Original NVD Description

R-SOFT DMS is vulnerable to Stored XSS in file upload functionality. Authenticated attacker can inject arbitrary HTML and JS into the name of the file being uploaded, which will be executed when visiting file list or upload status by other users. This issue was fixed in version v3.19-2832 and v3.17-2580.