CVE-2026-60043
CriticalCVSS 9.3Summary
An unauthenticated remote attacker can perform an XSS attack on a logged-in backend user, allowing execution of multiple critical system actions such as shutting down the server or restoring an uploaded backup.
Risk Assessment
This can result in a loss of integrity and availability, including unauthorized service shutdown or restoration of an unwanted backup.
Recommendation
Apply the vendor patches that fix the XSS vulnerability and consider additional input validation and backend session protection mechanisms.
Other vulnerabilities in Backend web application
See all- CVE-2026-60046High
An unauthenticated remote attacker can perform password resets for any user with a known username and email without rate limiting.
- CVE-2026-60041High
An unauthenticated remote attacker can perform a CSRF attack on a logged-in backend user, allowing execution of multiple critical system actions such as shutting down the server or restoring an uploaded backup.
- CVE-2026-60036High
A high-privileged remote attacker can perform code injection in the backend's patch activate function, leading to code execution.
- CVE-2026-60035High
A high-privileged remote attacker can perform code injection in the backend's network auth function, leading to code execution.
Original NVD description (English source)
An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of multiple critical system actions. This could allow an attacker to shutdown the server or restore an uploaded backup. This can result in a loss of integrity and availability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS