CVE-2026-92418

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-92418
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92418.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-92418
Published
2026-09-16T18:15:08Z
Modified
2026-10-08T02:52:32Z
Severity
  • 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
ChangeWeDer crm Save Endpoint customer.serve.js cross site scripting
Details

A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects unknown code of the file src/main/resources/public/js/customerServe/customer.serve.js of the component Save Endpoint. This manipulation of the argument customerName causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92418.json"
}
References

Affected packages

Git / github.com/changeweder/crm

Affected ranges

Type
GIT
Repo
https://github.com/changeweder/crm
Events
Introduced
c07bd4c97141521af6475034bc58523beed51bbd
Last Affected
c07bd4c97141521af6475034bc58523beed51bbd

Affected versions

Other
c07bd4c97141521af6475034bc58523beed51bbd

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92418.json"