CVE-2026-61501: fallo de gravedad media en rejetto hfs
Rejetto HFS < 3.2.1 Stored XSS in Admin Log Viewer
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.4%
Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator's browser when the logs are viewed, allowing the attacker to create accounts or execute code on the server with the administrator's privileges.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Productos afectados
rejetto · hfsCVEs relacionadas — rejetto hfs
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-61500CRITICALRejetto HFS < 3.2.1 Session Forgery via Predictable Signing KeyEPSS 1.9%CVE-2026-61505MEDIUMRejetto HFS < 3.2.1 Limited File Disclosure via Path Traversal in lang ParameterEPSS 0.5%CVE-2026-61503MEDIUMRejetto HFS < 3.2.1 Username Enumeration via Login Response DifferencesEPSS 0.4%CVE-2026-61504MEDIUMRejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web ListingEPSS 0.2%CVE-2026-61502MEDIUMRejetto HFS < 3.2.1 Cross-Site Request Forgery via GET RequestsEPSS 0.2%