CVE-2026-57279
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Cybozu Garoon contains a cross-site scripting vulnerability. If exploited, an arbitrary script may be executed in the web browser of a logged-in user.
Risk Assessment
An attacker could execute malicious scripts in the context of a logged-in user's session, potentially leading to data theft or session hijacking.
Recommendation
Apply patches provided by Cybozu Garoon vendor to remediate the XSS vulnerability.
Other vulnerabilities in Cybozu Garoon
See all- CVE-2016-7803High
SQL injection vulnerability in Cybozu Garoon versions 3.0.0 to 4.2.2 allows remote authenticated attackers to execute arbitrary SQL commands via the 'MultiReport' function.
- CVE-2016-4907High
Cybozu Garoon versions 3.0.0 to 4.2.2 allow remote attackers to obtain CSRF tokens via unspecified vectors.
- CVE-2016-1218High
CVE-2016-1218 describes an SQL injection vulnerability in Cybozu Garoon before version 4.2.2.
- CVE-2016-1193High
Cybozu Garoon versions 3.7 through 4.2 allow remote attackers to obtain sensitive email-reading information via unspecified vectors.
- CVE-2016-1189High
Cybozu Garoon versions 3.x and 4.x before 4.2.1 allow remote authenticated users to bypass intended restrictions on reading, creating, or modifying a portlet via unspecified vectors.
- CVE-2015-5646High
Cybozu Garoon versions 3.x through 3.7.5 and 4.x through 4.0.3 allow remote authenticated users to execute arbitrary PHP code via unspecified vectors.
- CVE-2015-5649High
Cybozu Garoon versions 3.x through 3.7.5 and 4.x through 4.0.3 mishandle authentication requests, allowing remote authenticated users to conduct LDAP injection attacks. This can lead to bypassing intended login restrictions or obtaining sensitive information by leveraging certain group-administration privileges.
- CVE-2014-1996High
Cybozu Garoon 3.7 before SP4 allows remote authenticated users to bypass intended access restrictions and execute arbitrary code or cause a denial of service via an API call.
- CVE-2016-1219Critical
Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use.
Original NVD description (English source)
Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS