CVE-2026-6283
MediumCVSS 5.4Summary
A stored cross-site scripting (XSS) vulnerability has been found in DivvyDrive by DivvyDrive Information Technologies Inc. The flaw is caused by improper input neutralization during web page generation, allowing injection of malicious scripts.
Risk Assessment
An attacker can hijack user sessions, steal data, or perform other malicious actions in the victim's browser context. The risk is especially high in multi-user environments sharing the same application instance.
Recommendation
Immediately upgrade DivvyDrive to version 4.8.3.1 or later, which includes a fix for this vulnerability. Before upgrading, consider restricting access to trusted users only.
Other vulnerabilities in DivvyDrive
See all- CVE-2026-5220Medium
A stored cross-site scripting (XSS) vulnerability has been found in DivvyDrive by DivvyDrive Information Technologies Inc., due to improper input neutralization during web page generation. The issue affects versions from 4.8.2.23 up to 4.8.3.0.
- CVE-2026-6002High
CVE-2026-6002 describes an improper neutralization of Script-Related HTML tags in web pages, leading to basic XSS vulnerabilities in DivvyDrive. The issue affects DivvyDrive versions from 4.8.2.9 before 4.8.3.2.
- CVE-2026-5784High
DivvyDrive has a 'cross-site scripting' (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from 4.8.2.9 before 4.8.3.2.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Stored XSS. This issue affects DivvyDrive: from v.4.8.2.23 before v.4.8.3.1.