CVE-2026-87948lowCWE-79

CVE-2026-87948: falha de baixa gravidade em Drupal SAML SSO - Service Provider

SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146

Publicada em

Seguir esta CVE+ Monitorar SAML SSO - Service Provider+ Monitorar drupal/miniorange_saml

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 3.5epss 0.2%
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Produtos afetados
Drupal · SAML SSO - Service Provider
CVEs relacionadas — Drupal SAML SSO - Service Provider

No mesmo produto, das mais perigosas para as menos.

CVE-2026-87950MEDIUMSAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148EPSS 0.3%CVE-2026-5343HIGHSAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031EPSS 0.3%CVE-2026-87951LOWSAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149EPSS 0.2%CVE-2026-87943MEDIUMSAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141EPSS 0.2%CVE-2026-87946MEDIUMSAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144EPSS 0.2%CVE-2026-87952LOWSAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150EPSS 0.2%