CVE-2026-71189: medium-severity vulnerability in Toptech Systems TMS7
Toptech TMS7 and TopHAT Cross-site Scripting
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.8epss 0.2%
exploitation probability
0.2%top 92% of all CVEs
observed exploitation
nono source reports it
An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Related CVEs — Toptech Systems TMS7
In the same product, most dangerous first.
CVE-2026-71379CRITICALToptech TMS7 and TopHAT Files or Directories Accessible to External PartiesEPSS 0.4%CVE-2026-70356CRITICALToptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous TypeEPSS 0.4%CVE-2026-72507HIGHToptech TMS7 and TopHAT SQL InjectionEPSS 0.3%CVE-2026-68068HIGHToptech TMS7 and TopHAT SQL InjectionEPSS 0.3%CVE-2026-68954HIGHToptech TMS7 and TopHAT SQL InjectionEPSS 0.3%CVE-2026-63713HIGHToptech TMS7 and TopHAT SQL InjectionEPSS 0.3%