EUVD-2026-62412
GHSA-jhx4-53p5-fq58
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Low-privileged network attacker injects script requiring active victim interaction; limited confidentiality and integrity impact within unchanged web application scope confirm C:L/I:L/A:N.
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
AnalysisAI
Cross-site scripting in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a low-privileged remote authenticated attacker to inject malicious JavaScript that executes in the browsers of other users, leading to information exposure such as session token theft or disclosure of management data. The CVSS vector confirms network accessibility with low attack complexity, but exploitation requires both a valid low-privileged account and a separate victim who interacts with the injected content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess a valid low-privileged account on the Dell OpenManage Enterprise web interface (confirmed by PR:L in the CVSS vector) - unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.6 Medium score is consistent with the constraint set: network-accessible (AV:N), low complexity (AC:L), but requiring a low-privileged account (PR:L) and victim interaction (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Dell OpenManage Enterprise to version 4.7.0 or later, as specified in Dell advisory DSA-2026-359 (https://www.dell.com/support/kbdoc/en-us/000500910/dsa-2026-359-security-update-for-dell-openmanage-enterprise-vulnerabilities). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Openmanage Enterprise
View allDell OpenManage Enterprise versions prior to 3.6.1 contain an improper authentication vulnerability. Rated critical seve
OS command injection in Dell OpenManage Enterprise prior to version 4.7.0 enables low-privileged remote attackers to exe
SQL injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a low-privileged remote attacker to ma
SQL injection in Dell OpenManage Enterprise prior to version 4.7.0 allows a low-privileged authenticated remote attacker
SQL injection in Dell OpenManage Enterprise prior to version 4.7.0 allows a remote attacker holding low-privilege creden
Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Control of Generation of Code ('Code In
Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. Rated high severity
Dell OpenManage Enterprise versions 3.4 through 3.6.1 and Dell OpenManage Enterprise Modular versions 1.20.00 through 1.
Dell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. Rated h
Remote OS command injection in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a high-privileged authen
Dell OpenManage Enterprise, v4.0 and prior, contain(s) a path traversal vulnerability. Rated high severity (CVSS 7.5), t
Privilege escalation in Dell OpenManage Enterprise versions prior to 4.7.0 allows a remote attacker already holding high
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today