CVE-2026-9292

The record

A Stored Cross-Site Scripting security issue exists within FactoryTalk® DataMosaix™ Private Cloud. The vulnerability stems from improper neutralization of user-supplied input within the Workflows configuration. An authenticated attacker with high privileges can inject malicious scripts that are permanently stored on the server. This vulnerability can result in the execution of malicious JavaScript when other users access the affected page, potentially allowing for account takeover, credential theft, or redirection to a malicious website.

Affected packages

Related vulnerabilities

• CVE-2026-62990 Shopper is a Headless e-commerce Admin Panel. CWE-79
• CVE-2026-117645 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')… CWE-79
• CVE-2026-94175 Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions. CWE-79
• CVE-2026-7004 WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site… CWE-79
• CVE-2026-54855 Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions. CWE-79
• CVE-2026-48201 Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions. CWE-79
• CVE-2026-39739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')… CWE-79
• CVE-2026-39786 Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions. CWE-79