DOM-Based Cross-Site Scripting Vulnerability in Stormshield Web Administration Panel
CVE-2026-113465

6.6MEDIUM

Key Information:

Vendor

Stormshield

Status
Stormshield Network Security
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113465?

A vulnerability exists in Stormshield’s web administration panel that allows an attacker to carry out a DOM-based Cross-Site Scripting (XSS) attack. By crafting a specially formatted URL containing a malicious script payload, the attacker can trick an authenticated administrator into clicking the link, leading to potential execution of the script in the context of the panel. This exploit highlights the risks associated with improper input validation and the importance of securing web applications against XSS threats.

Affected Version(s)

Stormshield Network Security 5.0.0 <= 5.0.9

Stormshield Network Security 5.1.0 <= 5.1.3

Stormshield Network Security 5.0.10

References

https://advisories.stormshield.eu/2026-022/

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

We acknowledge the researcher kto94 for discovering this vulnerability.
.