CVE-2026-75170

MediumCVSS 6.1

Published: 04/09/2026(UTC)Updated: 09/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

16th percentile - higher than 16% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1) allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter.

Risk Assessment

An attacker can execute scripts in the victim's browser, potentially leading to credential theft, session hijacking, or other malicious actions. The vulnerability can be used in phishing attacks.

Recommendation

It is recommended to update HubCore to a version with a fix for the language parameter validation. Also, apply output encoding and input filtering.

Other vulnerabilities in HubCore

CVE-2026-75171Critical
An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component.

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1) allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter.