EUVD-2026-71456
GHSA-8mh7-rg8h-phf4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-reachable web endpoint, no auth needed to craft payload, victim click required, scope changes to browser context; no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
A reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an unauthenticated attacker to inject arbitrary JavaScript code that is reflected and executed in the context of a victim's browser.
AnalysisAI
Reflected cross-site scripting in EMX Tecnologia Gestao X Business Suite 8.4 and earlier enables unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL targeting the /Configuracao/Imagens.aspx endpoint. The root cause is insufficient validation of the mensagem query parameter, which is reflected directly into the HTTP response without sanitization, enabling session hijacking, credential theft, or forced browser-side actions against authenticated users of this Brazilian ERP/business management platform. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must be a user of an EMX Tecnologia Gestao X Business Suite deployment running version 8.4 or earlier, and must be authenticated to the application at the time of exploitation (since the value of stealing session cookies is maximized against logged-in users, though the attacker themselves requires no authentication to craft the payload). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) accurately characterizes this as a medium-severity reflected XSS: no authentication is required to craft the payload, but victim interaction (UI:R) is mandatory, which is the primary exploitation barrier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been independently confirmed at time of analysis - the only references are the vendor product page and a Google Drive document (likely a researcher writeup). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today