CVE-2026-92085
MediumCVSS 5.4Summary
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co. Ltd. Talassoft Industrial Management Software allows Stored XSS. This issue affects Talassoft Industrial Management Software: before V16.0.1.
Risk Assessment
Stored XSS could allow an attacker to execute malicious scripts in a victim's browser, potentially leading to data theft, session hijacking, or other attacks. It requires user interaction, but could be used to attack other users of the system.
Recommendation
Update Talassoft Industrial Management Software to version V16.0.1 or later. Conduct a security audit of the application for other XSS vulnerabilities.
Other vulnerabilities in Talassoft Industrial Management Software
See all- CVE-2026-18931Critical
Use of Hard-coded Credentials vulnerability in Talassoft Industrial Management Software allows retrieval of embedded sensitive data. Affects versions from V.4 before V.16.
- CVE-2026-18780High
A Cross-Site Request Forgery (CSRF) vulnerability in Talassoft Industrial Management Software by TMT Machine Industry and Trade Ltd. Co. allows unauthorized actions to be performed on behalf of an authenticated user.
- CVE-2026-18771High
A missing authentication for critical function vulnerability in Talassoft Industrial Management Software by TMT Machine Industry and Trade Ltd. Co. allows authentication bypass and access to administrative functions without logging in.
- CVE-2026-18630High
SQL injection vulnerability in Talassoft Industrial Management Software by TMT Machine Industry and Trade Ltd. Co. due to improper neutralization of special elements in SQL commands. Affects versions from V.4 before V.16.
Original NVD description (English source)
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co. Ltd. Talassoft Industrial Management Software allows Stored XSS. This issue affects Talassoft Industrial Management Software: before V16.0.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS