Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Stormshield | Stormshield Network Security | unknown |
|
No data.
No data.
| Vendor | Product | Confidence | Versions | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Stormshield | Stormshield Network Security | 100% |
|
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
Vendor Solution
The following updates will fix this vulnerability: * SNS 5.1.4 EA * SNS 5.0.10 * SNS 4.8.20 LSTB * SNS 4.3.45 QS
Vendor Workaround
There is no workaround solution.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://advisories.stormshield.eu/2026-026/ |
|
Tue, 20 Oct 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 20 Oct 2026 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Stormshield
Stormshield stormshield Network Security |
|
| Vendors & Products |
Stormshield
Stormshield stormshield Network Security |
Tue, 20 Oct 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator. | |
| Title | Stored XSS on SNS Enrollment Portal | |
| Weaknesses | CWE-79 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: airbus
Published:
Updated: 2026-10-20T18:47:45.044Z
Reserved: 2026-10-20T18:08:04.738Z
Link: CVE-2026-113808
Vulnrichment
Updated: 2026-10-20T18:47:39.687Z
NVD
Status : Deferred
Published: 2026-10-20T19:17:34.193
Modified: 2026-10-20T19:35:23.397
Link: CVE-2026-113808
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-20T20:00:14Z
-
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')