CVE-2026-48999
MediumCVSS 5.7Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Attackers inject malicious scripts (e.g., JavaScript) into the target system. When other users visit infected pages, the scripts execute in their browsers, enabling cookie theft, session hijacking, and content tampering.
Risk Assessment
The organization is at risk of credential theft and account takeover. The attack has a broad scope and is difficult to detect.
Recommendation
Implement input validation and sanitization mechanisms and apply Content Security Policy (CSP) headers in web applications.
Other vulnerabilities in Web Application
See all- CVE-2026-71302High
The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover.
- CVE-2026-71189Low
An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application. This is a classic cross-site scripting (XSS) vulnerability.
- CVE-2026-69662Low
The application uses unsafe functions that allow execution of inline scripts and string evaluation functions. This may lead to execution of untrusted JavaScript code.
- CVE-2025-41716Medium
The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing authentication for critical function.
Original NVD description (English source)
Attackers carefully craft malicious scripts, such as JavaScript, and inject them into target systems; when other users access pages containing such malicious content, the scripts are automatically loaded and executed in the victim's browser.Attackers can thereby steal user cookies, hijack session privileges, and tamper with page content.Since the malicious code is stored within the system, the attack scope is broad and the concealment is strong, making it frequently employed for data theft attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS