CVE-2026-122095
7.6
/ 高危
2026-11-11
20h17 +00:00
20h17 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
AsiaInfo BSS Platform 9.2 before 9.2.38 has a stored cross-site scripting (XSS) vulnerability in the menu icon upload function. An authenticated user with ordinary application privileges can upload an SVG file containing embedded JavaScript, which is served from the application origin. Normal menu rendering uses an HTML ![]()
element and does not execute the SVG script; exploitation requires a victim to load the uploaded SVG as a document (by directly navigating to its URL, or via