{"id":"CVE-2026-78318","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-78318","generatedAt":"2026-10-28T08:11:18.643Z","title":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope.","description":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope.\n\n\n\nThe notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation.\n\n\n\nThis issue affects Apache Syncope: from 4.0.4 through 4.0.7, from 4.1.0-M0 through 4.1.2.\n\n\n\nUsers are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.","published":"2026-09-14T13:18:47.000Z","lastModified":"2026-09-14T20:58:48.000Z","status":"Deferred","sourceIdentifier":"security@apache.org","cvss":{"version":"3.1","score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":[],"epss":{"score":0.00263,"percentile":0.17996,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://lists.apache.org/thread/wmo15rczvd0w3ywjgqdrcznkb1v3qy9r","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/14/18","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-78318","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}