Cpe:2.3:a:asiainfo:bss_platform:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aasiainfobss_platform/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 22:09:44 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAsiaInfo BSS Platform Stored Cross-Site Scripting (XSS)https://feed.craftedsignal.io/briefs/2026-11-asiainfo-bss-xss-cve-2026-122095/Wed, 11 Nov 2026 22:09:44 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-asiainfo-bss-xss-cve-2026-122095/AsiaInfo BSS Platform 9.2 before 9.2.38 contains a stored cross-site scripting (XSS) vulnerability in the menu icon upload function allowing for arbitrary JavaScript execution.AsiaInfo BSS Platform 9.2 before 9.2.38 has a stored cross-site scripting (XSS) vulnerability in the menu icon upload function. An authenticated user with ordinary application privileges can upload an SVG file containing embedded JavaScript, which is served from the application origin. Exploitation requires a victim to load the uploaded SVG as a document, in which case the script executes under the application origin.

Impact

If a victim loads a malicious SVG as a document, the embedded script executes under the application origin.

Recommendation

Upgrade to AsiaInfo BSS Platform version 9.2.38 or later.

]]>highadvisory