CVE-2026-44669: falha de alta gravidade em factionsecurity faction
Faction: Stored XSS in Assessment Attachment Filename Preview Rendering
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.2%
FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, Faction is vulnerable to stored cross-site scripting (XSS) via attachment filenames in assessment file preview flows. User-supplied filename values are persisted and later rendered into HTML/attribute contexts without output encoding, allowing attacker-controlled JavaScript to execute in the browser of any user who views the affected page. Because the payload is stored server-side and rendered to other users, exploitation is persistent and can impact privileged accounts. This vulnerability is fixed in 1.8.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Produtos afetados
factionsecurity · factionCVEs relacionadas — factionsecurity faction
No mesmo produto, das mais perigosas para as menos.
CVE-2025-66022CRITICALFACTION Unauthenticated Custom Extension Upload leads to RCEEPSS 0.7%CVE-2025-27422HIGHFACTION Allows Authentication Bypass via User CreationEPSS 0.4%CVE-2026-44668CRITICALFaction: Unauthenticated Read, Modify, and Delete of Boilerplate TemplatesEPSS 0.4%CVE-2026-44667HIGHFaction: Stored XSS in Remediation Verification Attachment Filename Preview RenderingEPSS 0.2%