{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/asiainfo/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:asiainfo:bss_platform:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.6,"id":"CVE-2026-122095"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["BSS Platform (\u003c 9.2.38)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["AsiaInfo"],"content_html":"\u003cp\u003eAsiaInfo BSS Platform 9.2 before 9.2.38 has a stored cross-site scripting (XSS) vulnerability in the menu icon upload function. An authenticated user with ordinary application privileges can upload an SVG file containing embedded JavaScript, which is served from the application origin. Exploitation requires a victim to load the uploaded SVG as a document, in which case the script executes under the application origin.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eIf a victim loads a malicious SVG as a document, the embedded script executes under the application origin.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade to AsiaInfo BSS Platform version 9.2.38 or later.\u003c/p\u003e\n","date_modified":"2026-11-11T22:09:44Z","date_published":"2026-11-11T22:09:44Z","id":"https://feed.craftedsignal.io/briefs/2026-11-asiainfo-bss-xss-cve-2026-122095/","summary":"AsiaInfo BSS Platform 9.2 before 9.2.38 contains a stored cross-site scripting (XSS) vulnerability in the menu icon upload function allowing for arbitrary JavaScript execution.","title":"AsiaInfo BSS Platform Stored Cross-Site Scripting (XSS)","url":"https://feed.craftedsignal.io/briefs/2026-11-asiainfo-bss-xss-cve-2026-122095/"}],"language":"en","title":"CraftedSignal Threat Feed - AsiaInfo","version":"https://jsonfeed.org/version/1.1"}