CVE-2026-122095

AsiaInfo BSS Platform 9.2 before 9.2.38 has a stored cross-site scripting XSS vulnerability in the menu icon upload function. An authenticated user with ordinary application privileges can upload an SVG file containing embedded JavaScript, which is served from the application origin. Normal menu...