PT-2026-104806
CVE-2026-59788
·
تاريخ النشر
2026-10-05
·
تاريخ التحديث
2026-10-05
الوصف من
CVSS 4.0
5.6
متوسطةالمقاييسAV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
The product name cannot be determined (affected versions not specified)
Description
The email media type OAuth form fails to validate the URL scheme of the Authorization endpoint value before passing it to the
window.open() function. This allows the execution of a javascript: URL in the browser. An attacker can deliver a crafted media type configuration via an import file to execute arbitrary JavaScript in the context of the Super Admin who grants consent. This is a Stored Cross-Site Scripting (XSS) issue, where a malicious script is permanently stored on the server and executed when a user views the affected page.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾