AsiaInfo BSS Platform Stored Cross-Site Scripting (XSS)
AsiaInfo BSS Platform 9.2 before 9.2.38 contains a stored cross-site scripting (XSS) vulnerability in the menu icon upload function allowing for arbitrary JavaScript execution.
CVE search metadata
CVE search record: CVE-2026-122095. Severity: high. CVSS: 7.6. KEV: no. Product: BSS Platform (< 9.2.38). Brief: AsiaInfo BSS Platform Stored Cross-Site Scripting (XSS). Brief link: https://feed.craftedsignal.io/briefs/2026-11-asiainfo-bss-xss-cve-2026-122095/
Triage facts
Revision 1- Applicability
- BSS Platform (< 9.2.38)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 22:09 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
AsiaInfo BSS Platform 9.2 before 9.2.38 has a stored cross-site scripting (XSS) vulnerability in the menu icon upload function. An authenticated user with ordinary application privileges can upload an SVG file containing embedded JavaScript, which is served from the application origin. Exploitation requires a victim to load the uploaded SVG as a document, in which case the script executes under the application origin.
Impact
If a victim loads a malicious SVG as a document, the embedded script executes under the application origin.
Recommendation
Upgrade to AsiaInfo BSS Platform version 9.2.38 or later.