Stored Cross-Site Scripting Vulnerability in AsiaInfo BSS Platform
CVE-2026-122095

7.6HIGH

Key Information:

Vendor

Asiainfo

Status
Bss Platform
Vendor
CVE Published:
11 November 2026

What is CVE-2026-122095?

The AsiaInfo BSS Platform 9.2 prior to version 9.2.38 contains a stored cross-site scripting (XSS) vulnerability found in the menu icon upload function. This issue allows authenticated users with standard privileges to upload an SVG file that embeds JavaScript, which may be executed if a victim directly accesses the SVG's URL or incorporates it into the application via or . Although the normal menu rendering does not execute the SVG script, successful exploitation depends on user interaction, highlighting potential risks if unsuspecting users load the malicious content.

Affected Version(s)

BSS Platform 9.2.0 < 9.2.38

References

https://github.com/trevorkaon/vulnerability-security-rese...
third-party-advisory
https://orcid.org/0009-0007-0562-1331
issue-tracking

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.