CVE-2026-122095

{
  "etk_id": "ETK-2026-4211",
  "cve_id": "CVE-2026-122095",
  "display_id": "CVE-2026-122095",
  "ghsa_id": "GHSA-4g3v-6fqr-cmh3",
  "euvd_id": "EUVD-2026-123776",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in AsiaInfo BSS Platform",
  "summary": "AsiaInfo BSS Platform 9.2 releases before 9.2.38 are affected by stored cross-site scripting in the menu icon upload feature. An authenticated user with ordinary privileges can upload an SVG that may run script in the application origin if another user opens it as a document.",
  "mitigation": "Upgrade BSS Platform to version 9.2.38. Until upgraded, restrict menu-icon uploads and prevent uploaded SVG files from being opened or embedded as documents.",
  "vendor": "AsiaInfo",
  "product": "BSS Platform",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 9.2.0, < 9.2.38"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "9.2.38"
      ],
      "package_name": "BSS Platform",
      "purl": null
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 7.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 8.825274966666667,
  "t0_at": "2026-11-11T19:25:29.250000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-11T19:25:29.250000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-11T19:25:29.250000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-122095"
    }
  }
}