CVE-2026-5220
MediumCVSS 6.4Summary
A stored cross-site scripting (XSS) vulnerability has been found in DivvyDrive by DivvyDrive Information Technologies Inc., due to improper input neutralization during web page generation. The issue affects versions from 4.8.2.23 up to 4.8.3.0.
Risk Assessment
An attacker can inject a malicious script that executes in other users' browsers, potentially leading to session hijacking, account takeover, or data leakage.
Recommendation
Immediately upgrade DivvyDrive to version 4.8.3.1 or later, which includes a fix for this vulnerability.
Other vulnerabilities in DivvyDrive
See all- CVE-2026-6283Medium
A stored cross-site scripting (XSS) vulnerability has been found in DivvyDrive by DivvyDrive Information Technologies Inc. The flaw is caused by improper input neutralization during web page generation, allowing injection of malicious scripts.
- CVE-2026-6002High
CVE-2026-6002 describes an improper neutralization of Script-Related HTML tags in web pages, leading to basic XSS vulnerabilities in DivvyDrive. The issue affects DivvyDrive versions from 4.8.2.9 before 4.8.3.2.
- CVE-2026-5784High
DivvyDrive has a 'cross-site scripting' (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from 4.8.2.9 before 4.8.3.2.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Stored XSS. This issue affects DivvyDrive: from 4.8.2.23 before v.4.8.3.1.