Dashboard / CVE-2026-71881

CVE-2026-71881

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 45/100
Published: 2026-11-07 Modified: 2026-11-12 First seen: 2026-11-07 Status: active

Attack Surface

Network Low Complexity

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: Passive
S: X
AT: None
VC: Low
VI: Low
VA: None

Description

Multiple injection issues in resource metadata fields in GBIF Integrated Publishing Toolkit versions before 3.3.5 allows authenticated remote attackers to execute code in another user's session after user interaction via stored cross-site scripting

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
GBIF Integrated Publishing Toolkit 0 < 3.3.5
GBIF Integrated Publishing Toolkit 0 < 3.3.5

References & Advisories (2)

Bug Bounty Relevance

45 / 100
✓ Network accessible
✓ Low complexity

CVSS Score

4.8 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.41%
Raw Score 0.004150
Percentile 36.4%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00415
2026-11-12
0.00415
2026-11-10
0.00415
2026-11-09
0.00415
2026-11-08
0.00415
2026-11-07
0.00415

Intelligence Sources

mitre ref →
nvd ref →

External Links