PT-2026-91179

🗓️ 14 Sep 2026 00:00:00Reported by Positive TechnologiesType

XSS in Apache Syncope 4.0.4-4.0.7 and 4.1.0-M0-4.1.2 via malicious link on login pages.

Reporter	Title	Published	Views	Family All 12
CVE	CVE-2026-78318	14 Sep 202612:29	–	cve
Cvelist	CVE-2026-78318 Apache Syncope: Unauthenticated reflected XSS in Console and Enduser	14 Sep 202612:29	–	cvelist
EUVD	EUVD-2026-77439	14 Sep 202612:29	–	euvd
Mend	CVE-2026-78318	14 Sep 202612:29	–	mend
NVD	CVE-2026-78318	14 Sep 202613:18	–	nvd
Rapid7 Vulnerability Database (full)	CVE-2026-78318: Improper Neutralization of Input During Web Page Generation	14 Sep 202600:00	–	rapid7
Snyk	Cross-site Scripting (XSS)	14 Sep 202614:24	–	snyk
vulnersOsv	org.apache.syncope.client.am:syncope-client-am-console (>=4.1.0-m0, <=4.1.2), org.apache.syncope.client.am:syncope-client-am-enduser (>=4.1.0-m0, <=4.1.2) +12 more potentially affected by CVE-2026-78318 via org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui (>=4.1.0-m0, <=4.1.2)	14 Sep 202614:24	–	vulnersosv
vulnersOsv	org.apache.syncope.client.am:syncope-client-am-console (>=4.0.4, <=4.0.7), org.apache.syncope.client.am:syncope-client-am-enduser (>=4.0.4, <=4.0.7) +12 more potentially affected by CVE-2026-78318 via org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui (>=4.0.4, <=4.0.7)	14 Sep 202612:29	–	vulnersosv
vulnersOsv	org.apache.syncope.client.am:syncope-client-am-console (>=4.1.0-m0, <=4.1.2), org.apache.syncope.client.am:syncope-client-am-enduser (>=4.1.0-m0, <=4.1.2) +12 more potentially affected by CVE-2026-78318 via org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui (>=4.1.0-m0, <=4.1.2)	14 Sep 202612:29	–	vulnersosv