Get real-time updates on Telegram
P5
CVE-2026-41877: DMS 0 to before v3.19-2832, 0 to before v3.17-2580
CVE-2026-41877. EPSS 0.0039 (percentile 0.31938), scored 24-Oct-2026.
Affected technology
DMS · 0 to before v3.19-2832, 0 to before v3.17-2580
R-SOFT SERWIS
Component: Not specified by the source
File: being
Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · Passive user interaction
What an attacker can do
Authenticated attacker can inject arbitrary HTML and JS into the name of the file being uploaded, which will be executed when visiting file list or upload status by other users. Vendor/CNA’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality and availability impact as none; integrity impact as low.
- CWE
- CWE-79
- CCR priority
- 0.1 /100 (P5)
- EPSS
- 0.0039 · percentile 0.32811 · 2026-10-25
- KEV
- no
Provenance
- FIRST EPSS daily exploit-probability · Source record · observed 2026-10-25 19:52:47.952465+00:00 UTC
- NVD CVE API 2.0 · Source record · observed 2026-10-25 19:51:06.643138+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-41877.html