EUVD-2026-89476
GHSA-c626-px4f-p5qx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated app user crafts the request (PR:L), a victim must issue it (UI:R), script executing in another user's browser crosses a security boundary (S:C) with low confidentiality/integrity session impact.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
4DescriptionCVE.org
An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.
AnalysisAI
Cross-site scripting (CWE-79) in Toptech Systems' TMS7 terminal management platform (and the related TopHat product) allows an authenticated attacker to inject JavaScript that executes in a second application user's browser within that user's active session. Exploitation is not remotely triggerable against a default installation: it requires the attacker to hold valid application credentials (PR:L per the assessed vector) and to socially engineer a logged-in user into issuing the attacker-constructed request (UI:A), with impact confined to the victim's session and limited to low confidentiality effect. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold valid authenticated access to the TMS7/TopHat application (PR:L) and to induce a second, typically higher-privileged, application user to issue the attacker-constructed request (UI:A / victim interaction). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority reflected/social-engineered XSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Toptech TMS7 version 7.8 or later - this is the vendor-released patch and the only complete fix identified in the available data; for TopHat, obtain the corresponding fixed release from Toptech, as no specific TopHat version is given in the input. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Toptech Systems TMS7 and TopHat expose a file export endpoint that lets any network-reachable, unauthenticated attacker
Arbitrary PHP file upload and execution is possible in Toptech Systems TMS7 and TopHat version 7.6.3, because the TMS fi
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat lets an authenticated, high-privilege operator inject
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat terminal management software lets an authenticated hig
Time-based blind SQL injection in the home-page search function of Toptech Systems' TMS7 terminal management application
Time-based blind SQL injection in the 'search' parameter of the view-audit-logs feature (utilities section) of Toptech S
Time-based blind SQL injection in the business allocation search feature of Toptech Systems TMS7 and TopHat 7.6.3 and ea
Session fixation (CWE-384) in Toptech Systems TMS7 and TopHat terminal management platforms allows an attacker to seed a
Remote code execution in Tophat mobile testing harness prior to 2.5.1 allows authenticated network attackers to execute
Authenticated attackers positioned on the adjacent network can abuse unsafe inline-script and string-evaluation (eval-cl
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today