CVE Catalog
CVE-2026-36748
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk0.30%
22th percentile - higher than 22% of all known CVEs
Summary
RockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting (XSS) via Social Media links in user profile.
Risk Assessment
The risk includes execution of malicious scripts in the victim's browser, which could lead to session theft, redirection to malicious sites, or data theft.
Recommendation
Update RockRMS to version 17.7.0 or later, which contains the fix, and apply proper output encoding for social media links.
Original NVD description (English source)
RockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting (XSS) via Social Media links in user profile.