CVE-2026-75933

HighCVSS 7.3

Published: 21/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 21/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain.

Risk Assessment

An attacker can steal credentials or perform other malicious actions in the context of other users' sessions, potentially leading to application security compromise.

Recommendation

Upgrade Jet Admin to a version that includes a fix preventing JavaScript injection via the scripts and styles option.

Other vulnerabilities in Jet Admin

CVE-2026-75932High
Jet Admin allows an attacker to create a malicious app, connect it to a target user's custom domain, edit authentication configuration, and reroute traffic to the attacker-controlled app. If the victim uses an OAuth provider, the attacker obtains the victim's OAuth Client ID and Client Secret.

Original NVD description (English source)

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain.