CVE-2026-25735mediumCWE-1004CWE-79

CVE-2026-25735: falha de média gravidade em rucio

Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar rucio+ Monitorar rucio-webui

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.1epss 0.3%
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting (XSS) vulnerability in the Identity Name of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of the WebUI for users who view affected pages, potentially enabling session token theft or unauthorized actions. Versions 35.8.3, 38.5.4, and 39.3.1 fix the issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Produtos afetados
rucio · rucio
CVEs relacionadas — rucio

No mesmo produto, das mais perigosas para as menos.

CVE-2026-25138MEDIUMRucio WebUI has Username Enumeration via Login Error MessageEPSS 0.4%CVE-2026-25736MEDIUMRucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE AttributeEPSS 0.3%CVE-2026-25734MEDIUMRucio WebUI has Stored Cross-site Scripting (XSS) in RSE MetadataEPSS 0.3%CVE-2026-25136HIGHRucio WebUI has a Reflected Cross-site Scripting VulnerabilityEPSS 0.3%CVE-2026-25733HIGHRucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule FunctionEPSS 0.3%CVE-2026-29090CRITICALRucio SQL injection in postgres_meta DID search path compromises PostgreSQL metadata databaseEPSS 0.3%