What is the CVSS score of EUVD-2026-17095?

EUVD-2026-17095 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

N A EUVD-2026-17095

| CVE-2026-30082 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-30 mitre

GHSA-xm7v-wmqf-6g4f

XSS N A

6.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 30, 2026 - 15:15 euvd

EUVD-2026-17095

Analysis Generated

Mar 30, 2026 - 15:15 vuln.today

CVE Published

Mar 30, 2026 - 00:00 nvd

MEDIUM 6.1

DescriptionCVE.org

Multiple stored cross-site scripting (XSS) vulnerabilities in the Edit feature of the Software Package List page of IngEstate Server v11.14.0 allow attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the About application, What's news, or Release note parameters.

AnalysisAI

Stored cross-site scripting (XSS) vulnerabilities in IngEstate Server v11.14.0 allow remote attackers to execute arbitrary web scripts or HTML by injecting malicious payloads into the About application, What's news, or Release note parameters within the Software Package List edit feature. The vulnerabilities affect the stored XSS class, meaning injected payloads persist and execute for all users accessing the affected page. Public exploit code is available on GitHub, and the vendor (IngEstate/Ingenico) has not released a confirmed patched version as of this analysis.

Technical ContextAI

The vulnerability exists in the edit functionality of the Software Package List page, where user-supplied input from three specific parameters-About application, What's news, and Release note-is not properly sanitized or encoded before being stored in the application's data store and subsequently rendered in HTML responses. This is a classic stored XSS vulnerability (CWE-79 type flaw, though CWE not provided in input). The affected technology is IngEstate Server, a software package management platform. The vulnerability class is stored/persistent XSS rather than reflected, meaning the injected JavaScript or HTML persists in the backend database and is served to all subsequent users who view the Software Package List edit page, amplifying the attack surface and impact. The CPE data provided is generic (n/a:n/a), suggesting the vulnerability entry lacks specific product identification in the CPE database, though the vendor and product name are clearly identified in the description and references.

RemediationAI

Upgrade IngEstate Server to a version newer than 11.14.0 if a patched release is available from Ingenico/IngEstate vendor channels (verify at http://ingestate.com). If a patched version is not yet released, implement input validation and output encoding controls: sanitize all user input to the About application, What's news, and Release note parameters using an XSS filtering library (e.g., OWASP ESAPI or DOMPurify), and apply HTML entity encoding to all dynamic content rendered in the Software Package List edit page. Additionally, implement Content Security Policy (CSP) headers to restrict script execution origins, reducing XSS impact. Contact Ingenico support or monitor http://ingestate.com and https://ingenico.com/ for security updates. No vendor-released patch version has been confirmed at time of analysis.