CVE-2026-40699
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
May 13, 2026
CISA due date
—
The record
A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-44962 Plesk contains an XPath injection vulnerability in the APS Application Catalog search… CWE-643
- CVE-2026-24343 Improper Neutralization of Data within XPath Expressions ('XPath Injection')… CWE-643
- GHSA-r7vr-wg3f-8hr9 Concrete5 CMS contains an XPath injection vulnerability CWE-643
- CVE-2022-50807 Concrete5 CMS contains an XPath injection vulnerability CWE-643