CVE-2026-66146
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user's browser.
Risk Assessment
Executing JavaScript in the user's browser could lead to session theft, account takeover, or displaying fake content, potentially compromising trust in the system.
Recommendation
It is recommended to immediately update GMS to a version that includes fixes for XSS vulnerabilities. Also, implement input filtering and output encoding mechanisms in the application.
Other vulnerabilities in GMS
See all- CVE-2026-66145Critical
An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip.
- CVE-2026-18634High
An insecure handling of serialized objects vulnerability was found in one of the services of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to interact with the service could exploit this behavior to perform unauthorized actions through the affected component.
Original NVD description (English source)
Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user's browser.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS