To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into visiting that link.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Stormshield | Stormshield Network Security | unknown |
|
No data.
No data.
No data available yet.
Vendor Solution
The following updates will fix this vulnerability: * SNS 5.1.4 EA * SNS 5.0.10
Vendor Workaround
There is no workaround solution.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://advisories.stormshield.eu/2026-022/ |
|
Tue, 20 Oct 2026 12:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into visiting that link. | |
| Title | Possible DOM XSS in SNS Web Administration Portal | |
| Weaknesses | CWE-79 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: airbus
Published:
Updated: 2026-10-20T08:09:33.956Z
Reserved: 2026-10-20T08:03:11.466Z
Link: CVE-2026-113465
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-20T09:17:09.473
Modified: 2026-10-20T09:17:09.473
Link: CVE-2026-113465
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')