What’s Vulnerable › Vulnerabilities

CVE-2022-26961

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-04 · updated 2026-09-09
• Weakness: CWE-79

Description

Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui/backup_restore.jsp and NP_IBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the name parameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will then be triggered every time an authenticated user browses the page containing it.

References

• https://www.gruppotim.it/it/footer/red-team/2022/CVE-2022-26961-Italtel-NETMATCH-S-CLOUD-INSIDE-VNF.html

Get alerted when CVE-2022-26961 or the next vulnerability affects your stack