CVE-2026-7172

Name of the Vulnerable Software and Affected Versions TPVEnlanube (affected versions not specified)

Description Stored Cross-Site Scripting (XSS) occurs when an authenticated attacker injects malicious code into the Nombre Completo parameter at the '/administrator/index.php?option=com virtuemart&page=admin.user list' endpoint. This allows the execution of arbitrary code in the browsers of other users without their consent.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the Nombre Completo parameter in the '/administrator/index.php?option=com virtuemart&page=admin.user list' endpoint until the issue is resolved.