What is the CVSS score of EUVD-2026-34782?

EUVD-2026-34782 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-34782?

Yes, a patch is available for EUVD-2026-34782. Update the affected software to the latest version immediately.

Znuny EUVD-2026-34782

| CVE-2026-50591 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-05 mitre

GHSA-qfgf-x7qr-jq6q

XSS Znuny

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 05, 2026 - 04:16 EUVD

Analysis Generated

Jun 05, 2026 - 03:20 vuln.today

DescriptionCVE.org

IN Znuny LTS before 6.5.21 and Znuny before 7.3.3, XSS can occur via stored user preferences.

AnalysisAI

Stored cross-site scripting in Znuny's user preferences mechanism allows an authenticated low-privileged attacker to inject persistent malicious scripts that execute in other users' browsers, crossing security boundaries (S:C) to potentially compromise administrator sessions or perform unauthorized actions on their behalf. Both the LTS branch (before 6.5.21) and the main release branch (before 7.3.3) are affected. Vendor-released patches exist for both branches; no public exploit identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Znuny is an open-source IT service management and customer support ticketing platform, forked from OTRS, used widely in enterprise helpdesk environments. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): user-supplied data submitted to the preferences storage layer is persisted server-side without adequate sanitization and subsequently rendered in other users' browser contexts without proper output encoding. The scope-changed flag in the CVSS vector (S:C) is significant - it indicates that the injected payload can affect users outside the attacker's own session, such as agents, supervisors, or administrators who view the stored preference data. The CPE identifier cpe:2.3:a:znuny:znuny:*:*:*:*:*:*:*:* covers all Znuny application versions, with exploitation bounded below the confirmed fix versions.

RemediationAI

The primary fix is to upgrade to Znuny LTS 6.5.21 or Znuny 7.3.3, per the vendor advisory at https://www.znuny.org/en/advisories/zsa-2026-11. If immediate patching is not feasible, consider the following compensating controls with their trade-offs: restrict user preference modification to trusted or internal accounts only by adjusting role-based access controls within Znuny, which limits self-service functionality for external users; deploy a Content Security Policy (CSP) response header that restricts inline script execution and unauthorized script sources - note that Znuny's interface may use inline scripts that require careful policy tuning to avoid breaking legitimate functionality; and audit existing stored user preferences for unexpected script-like content prior to patching, as stored payloads persist until remediated regardless of the patch state.