EUVD-2026-83863
GHSA-hwwr-jxp3-vffw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated upload capability makes PR:H, victim rendering makes UI:R, stored SVG executing in another user's browser is a scope change (S:C) with limited C:L/I:L and no availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Cross-site scripting in Omega HRM OS up to 20260717 allows an authenticated attacker with high privileges and file-upload permissions to inject malicious SVG files through the /media/view/ endpoint. Publicly available exploit code exists, enabling attacks that execute arbitrary JavaScript in a victim's browser when they view the crafted SVG. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated account with file-upload permission to the SVG File Upload component (/media/view/) of Omega Solution HRM OS (versions up to 20260717) - consistent with the vendor's PR:H rating - and a second user must open/view the malicious SVG (UI:P), since XSS payloads in SVG only execute when rendered in a browser context. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority stored/reflected XSS via SVG file upload. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch is available at the time of analysis; the vendor was contacted but did not respond. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Missing authentication in the Role Permission API of Omega Solution HRM OS (versions up to 20260717) lets remote, unauth
Improper control of resource identifiers in Omega Solution HRM OS (versions up to 20260717) allows an authenticated low-
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today