CVE-2026-103664

MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...

EUVD-2026-90578

MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...

CVE-2026-103664

MISP is vulnerable to reflected cross-site scripting (XSS) in the analyst data notes panel. The root cause is the lack of sanitization or type enforcement on the seed path parameter supplied via the URL, which is passed directly into inline JavaScript within the HTML response. An authenticated at...

CVE-2026-103664 MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter

MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...