MEDIUMCVSS v3.1 4.7Vulnerability
CVE-2026-128029
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store, type, or attribute_set columns of an import file to run script in the session of the administrator who imports it.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-14T00:40:25.638091+00:00
- Epss score
- 0.00303
- Cvss score
- 4.7
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-14T00:51:03+00:00
- Score
- 4.7
- Last source
- FIRST EPSS
- Cvss version
- 3.1
- Cve id
- CVE-2026-128029
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- First seen by Signal
- 2026-11-13T17:31:47+00:00
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Published at
- 2026-11-13T10:18:08.850
- Last modified
- 2026-11-13T19:19:29.860
- Epss percentile
- 0.23359
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph