What is the CVSS score of CVE-2026-28130?

CVE-2026-28130 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of AndonDesign UDesign are affected by CVE-2026-28130?

A reflected cross-site scripting (XSS) vulnerability in AndonDesign UDesign (versions 4.14.0 and earlier) allows attackers to inject malicious scripts that execute in users' browsers, potentially…

How to fix or mitigate CVE-2026-28130?

Within 24 hours: Inventory all UDesign deployments and restrict access to trusted networks only; disable UDesign if not business-critical. Within 7 days: Deploy WAF rules to block common XSS payloads and implement input validation filters; conduct security awareness training on phishing and suspicious links. Within 30 days: Monitor vendor for patch availability; evaluate alternative products or architecture changes to reduce exposure; conduct incident response tabletop exercise.

AndonDesign UDesign CVE-2026-28130

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-05 audit@patchstack.com

XSS

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AndonDesign UDesign u-design allows Reflected XSS.This issue affects UDesign: from n/a through <= 4.14.0.

AnalysisAI

Reflected cross-site scripting in AndonDesign UDesign versions up to 4.14.0 enables attackers to inject malicious scripts into web pages viewed by users, potentially allowing session hijacking, credential theft, or malware distribution. The vulnerability requires user interaction to click a malicious link but can affect any organization using the affected UDesign versions. No patch is currently available to remediate this issue.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects AndonDesign UDesign u-design. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AndonDesign UDesign u-design allows Reflected XSS.This issue affects UDesign: from n/a through <= 4.14.0.

Affected ProductsAI

Product: AndonDesign UDesign u-design.

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.