CVE-2026-1008highCWE-79

CVE-2026-1008: fallo de gravedad alta en Altium Live

Stored Cross-Site Scripting in Altium Live User Profile Fields

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Altium Live

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.6epss 0.2%
A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365. Insufficient server-side input sanitization allows authenticated users to inject arbitrary HTML and JavaScript payloads using whitespace-based attribute parsing bypass techniques. The injected payload is persisted and executed when other users view the affected profile page, potentially allowing session token theft, phishing attacks, or malicious redirects. Exploitation requires an authenticated account and user interaction to view the crafted profile.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Productos afectados
Altium · Altium Live
CVEs relacionadas — Altium Live

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-1011MEDIUMStored Cross-Site Scripting in Altium Live Support Center Comment EndpointEPSS 0.3%CVE-2026-1009CRITICALStored Cross-Site Scripting in Altium Live Forum Leading to Cross-Customer Data ExposureEPSS 0.2%