EUVD-2026-23114Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component. Requires a high privileged user with a developer role.
AnalysisAI
Stored cross-site scripting in Pega Infinity allows high-privileged users with developer roles to inject scripts in the UI, potentially affecting other users who view the injected content. No known exploitation or public exploit code exists, and exploitation requires authentication as a developer. The vulnerability has a CVSS 4.0 score of 4.8 (Medium)
More in Pega Infinity
View allPega Platform (marketed as Pega Infinity) versions 7.1.0 through 25.1.2 expose a network-accessible, unauthenticated att
Cryptographic signature validation failure in Pega Platform (Pega Infinity) versions 8.5.0 through 25.1.2 enables low-pr
Authorization bypass in Pega Platform versions 8.3.0 through Infinity 25.1.2 allows authenticated users to access additi
HTML injection in Pega Platform 8.1.0 through 25.1.1 allows an authenticated high-privileged user with developer role to
Reflected cross-site scripting in Pega Platform (Pega Infinity) versions 8.1.0 through 25.1.2 allows a high-privileged a
Stored cross-site scripting (XSS) in Pega Platform versions 8.1.0 through 25.1.0 allows authenticated administrative use
Stored cross-site scripting in Pega Platform (Pega Infinity) versions 8.1.0 through 25.1.2 allows a high-privileged deve
Stored cross-site scripting in Pega Platform (Pega Infinity) versions 23.1.0 through 25.1.3 allows a high-privileged dev
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today