What’s Vulnerable › Vulnerabilities

CVE-2026-36162

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-07 · updated 2026-07-09
• Weakness: CWE-79

Description

An authenticated stored cross-site scripting (XSS) vulnerability in the Upload File Shares API of LiquidFiles v4.2.7 allows attackers to execute arbitrary Javascript or HTML via injecting a crafted payload into the Name parameter.

References

• https://docs.liquidfiles.com/release_notes/version_4-2-x.html
• https://securing.pl/en/bypassing-csp-to-exploit-stored-xss-in-liquidfiles/
• https://securing.pl/en/bypassing-csp-to-exploit-stored-xss-in-liquidfiles/

Get alerted when CVE-2026-36162 or the next vulnerability affects your stack