Dashboard / CVE-2026-128029

CVE-2026-128029

LOW
INFO Priority: 0.01 BB Relevance: 45/100
Published: 2026-11-13 Modified: 2026-11-13 First seen: 2026-11-13 Status: active

Attack Surface

Network No Auth

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: Passive
S: X
AT: Present
VC: Low
VI: Low
VA: None

Description

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store, type, or attribute_set columns of an import file to run script in the session of the administrator who imports it.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
OpenMage magento-lts 0 < 20.18.2
OpenMage magento-lts 21.0.0-beta1 < 21.0.0-beta3

References & Advisories (3)

Bug Bounty Relevance

45 / 100
✓ Network accessible
✓ No authentication

CVSS Score

2.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.30%
Raw Score 0.003030
Percentile 23.4%
Date 2026-11-13

Intelligence Sources

mitre ref →
nvd ref →

External Links