CVE-2026-30082

Stored Cross-site Scripting (XSS) vulnerabilities in the Edit feature of the Software Package List page of IngEstate Server

Affected version: IngEstate Server - 11.14.0

Affected Function

Affected API: Affected API: PUT /emgui/rest/appDatasheet//?full=true HTTP/1.1

PoC

To exploit this Stored Cross-Site Scripting (XSS) vulnerability, an authenticated user must first access the Software Package List page through the dashboard. The Edit feature interacts with the API endpoint /emgui/rest/appDatasheet/. An attacker can then inject an XSS payload into the 'About application', 'What's news', or 'Release note' parameters. Once injected, the malicious JavaScript is saved on the server and automatically executes when other users later view those sections.

Result

An attacker can execute arbitrary JavaScript code in other users' browsers, leading to session hijacking, credential theft, or unauthorized actions performed on the victim's behalf. This vulnerability affects all users who view the compromised Software Package information.

Finder