CVE-2026-2342

CriticalCVSS 9.3

Published: 09/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

31th percentile - higher than 31% of all known CVEs

Summary

A stored Cross-Site Scripting (XSS) vulnerability has been found in ValeApp by OceanicSoft Informatics Systems Ltd., due to improper input neutralization during web page generation. This issue affects all versions up to 09072026.

Risk Assessment

An attacker can inject a malicious script that executes in other users' browsers, potentially leading to session theft, account takeover, or sensitive data leakage.

Recommendation

Immediately update ValeApp to the latest version after 09072026 or apply temporary mitigations such as input filtering and encoding.

Original NVD description (English source)

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OceanicSoft Informatics Systems Ltd. ValeApp allows Stored XSS. This issue affects ValeApp: through 09072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.