Dashboard / CVE-2026-124435

CVE-2026-124435

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 44/100
Published: 2026-11-08 Modified: 2026-11-10 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: Active
S: X
AT: None
VC: None
VI: None
VA: None

Description

OpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows authenticated users with write:admin permissions to upload HTML or SVG files containing JavaScript via the Manager configuration file upload endpoint. Attackers can lure victims to the unauthenticated image retrieval endpoint, which serves files as text/html or image/svg+xml, executing scripts within the application's origin.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
openremote core 0 < 1.32.2
openremote core 0 < 1.32.2

References & Advisories (2)

Bug Bounty Relevance

44 / 100
✓ Network accessible
✓ Low complexity

CVSS Score

4.6 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.18%
Raw Score 0.001800
Percentile 7.7%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00180
2026-11-12
0.00180
2026-11-10
0.00180
2026-11-09
0.00180

Intelligence Sources

mitre ref →
nvd ref →

External Links