CVE-2026-113465 PUBLISHED

Possible DOM XSS in SNS Web Administration Portal

Assigner: airbus
Reserved: 20.10.2026 Published: 20.10.2026 Updated: 20.10.2026

It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel.

To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into visiting that link.

Metrics

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
CVSS Score: 6.6

Product Status

Vendor Stormshield
Product Stormshield Network Security
Versions Default: unknown
  • affected from 5.0.0 to 5.0.9 (incl.)
  • affected from 5.1.0 to 5.1.3 (incl.)
  • Version 5.0.10 is unaffected
  • Version 5.1.4 EA is unaffected

Workarounds

There is no workaround solution.

Solutions

The following updates will fix this vulnerability: * SNS 5.1.4 EA

  • SNS 5.0.10

Credits

  • We acknowledge the researcher kto94 for discovering this vulnerability. finder

References

Problem Types

  • CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') CWE