EUVD-2026-23112
GHSA-hm98-22vr-c62v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role.
AnalysisAI
HTML injection in Pega Platform 8.1.0 through 25.1.1 allows an authenticated high-privileged user with developer role to inject malicious HTML into a user interface component. This could enable cross-site scripting attacks against other users or content manipulation, but exploitation requires
More in Pega Infinity
View allPega Platform (marketed as Pega Infinity) versions 7.1.0 through 25.1.2 expose a network-accessible, unauthenticated att
Cryptographic signature validation failure in Pega Platform (Pega Infinity) versions 8.5.0 through 25.1.2 enables low-pr
Authorization bypass in Pega Platform versions 8.3.0 through Infinity 25.1.2 allows authenticated users to access additi
Reflected cross-site scripting in Pega Platform (Pega Infinity) versions 8.1.0 through 25.1.2 allows a high-privileged a
Stored cross-site scripting in Pega Infinity allows high-privileged users with developer roles to inject scripts in the
Stored cross-site scripting (XSS) in Pega Platform versions 8.1.0 through 25.1.0 allows authenticated administrative use
Stored cross-site scripting in Pega Platform (Pega Infinity) versions 8.1.0 through 25.1.2 allows a high-privileged deve
Stored cross-site scripting in Pega Platform (Pega Infinity) versions 23.1.0 through 25.1.3 allows a high-privileged dev
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today