What is the CVSS score of CVE-2026-2342?

CVE-2026-2342 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Valeapp are affected by CVE-2026-2342?

OceanicSoft ValeApp (all builds through 09072026) contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts executed in other users' browser sessions,…

How to fix or mitigate CVE-2026-2342?

Within 24 hours: inventory all ValeApp deployments, assess business criticality, and notify affected users that their sessions are at risk of compromise. Within 7 days: deploy WAF rules to block script injection payloads, implement strict Content Security Policy headers, and isolate ValeApp from systems containing sensitive data if it is non-critical. Within 30 days: establish weekly monitoring for vendor security advisories, conduct a formal business continuity review to evaluate replacement applications, and prepare migration or decommissioning timeline if no patch is released within 60 days.

Valeapp CVE-2026-2342

EUVD-2026-42554 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-07-09 TR-CERT

GHSA-6qfw-hj6c-73wv

XSS Valeapp

9.3

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Primary rating from Vendor (TR-CERT) · only source for this CVE.

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 10:05 vuln.today

DescriptionCVE.org

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OceanicSoft Informatics Systems Ltd. ValeApp allows Stored XSS.

This issue affects ValeApp: through 09072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stored cross-site scripting in OceanicSoft ValeApp (all builds through 09072026) lets an attacker persist malicious script into the application so it executes in other users' browser sessions when they view the affected page. Reported by Turkey's national CERT (TR-CERT) and tracked in the ENISA EUVD, the flaw carries a vendor/CERT CVSS of 9.3 driven by a scope change and high confidentiality/integrity impact. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor was unresponsive to disclosure, so no fix is expected in the near term.