CVE-2026-47790

MediumCVSS 6.3

Published: 15/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.48%

40th percentile - higher than 40% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. The vulnerability has been fixed in versions 1.4.6, 1.5.5, and 1.6.5 and later.

Risk Assessment

Injection of malicious code may lead to session theft, account takeover, or actions performed on behalf of the user.

Recommendation

Update QuFTP Service to version 1.4.6, 1.5.5, or 1.6.5 (or later) and restrict access to the service to trusted users only.

Other vulnerabilities in QuFTP Service

CVE-2026-22895Medium
A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. A remote attacker with an administrator account can exploit this vulnerability to bypass security mechanisms or read application data.

Original NVD description (English source)

A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: QuFTP Service 1.4.6 and later QuFTP Service 1.5.5 and later QuFTP Service 1.6.5 and later

Vulnerability data from NVD (NIST) · CISA KEV · EPSS