CVE-2026-7171

Name of the Vulnerable Software and Affected Versions TPVEnlanube (affected versions not specified)

Description An authenticated attacker can perform Stored Cross-Site Scripting (XSS), which occurs when a malicious script is permanently stored on the target server. This allows the execution of malicious code in the browsers of other users without their consent via the endpoint '/administrator/index.php?page=admin.user add&user id=45&option=com virtuemart' through the Apellido 1 parameter.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the parameter Apellido 1 in the affected API endpoint until the issue is resolved.