SEPTEMBER 30, 2026
Live Feed
Back to database
Case File

CVE-2026-91928

MEDIUM · CVSS 6.1 EPSS 0.17%

Source: NVD + CISA KEV + EPSS · Published 2026-09-23 · Last synced 2026-09-30

CyberRota Analysis

AI-Generated

Apache Sling XSS versions prior to 2.4.12 are vulnerable to a cross-site scripting (XSS) flaw due to improper input neutralization during web page generation. This vulnerability could allow attackers to inject malicious scripts into web pages viewed by users, potentially leading to data theft or session hijacking. Organizations using affected versions should prioritize upgrading to 2.4.12 to mitigate these risks.

CVE
CVE-2026-91928
Severity
MEDIUM
CVSS
6.1
EPSS
0.17%
Apache

Original NVD Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

Related CVEs

Other vulnerabilities affecting the same vendor(s)

CVE-2026-92001 MEDIUM CVE-2026-91999 MEDIUM CVE-2026-91852 MEDIUM CVE-2026-73192 MEDIUM CVE-2026-86473 CRITICAL CVE-2026-82355 MEDIUM