CVE-2026-50040mediumCWE-79

CVE-2026-50040: fallo de gravedad media en StoneFly Storage Concentrator

Cross-site Scripting in StoneFly Storage Concentrator

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Storage Concentrator+ Monitorear Storage Concentrator Virtual Machine

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.1epss 0.3%
Storage Concentrator (SC & SCVM) is vulnerable to reflected cross-site scripting due to unsanitized content being echoed back in 404 error pages. An attacker can craft a malicious URL that, when visited by an authenticated user, causes arbitrary script content to execute within the victim's browser session in the context of the application. This could be leveraged to steal session cookies, redirect users, or perform unauthorized actions on behalf of the victim.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N
Productos afectados
StoneFly · Storage ConcentratorStoneFly · Storage Concentrator Virtual Machine
CVEs relacionadas — StoneFly Storage Concentrator

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-56413CRITICALOS Command Injection in StoneFly Storage ConcentratorEPSS 4.2%CVE-2026-55721CRITICALSQL Injection in StoneFly Storage ConcentratorEPSS 0.5%CVE-2026-50110CRITICALUse of Hard-coded Credentials in StoneFly Storage ConcentratorEPSS 0.2%