Stored Cross-Site Scripting in Worksuite SaaS Asset Management Module

CVE-2026-18741

What is CVE-2026-18741?

The Worksuite SaaS platform, in versions prior to 6.0.14, is affected by a stored cross-site scripting vulnerability within its Asset Management module. This allows authenticated administrators to submit malicious JavaScript payloads in the Location and Description fields when adding new assets. These payloads can be stored in the database, leading to automatic execution in user browsers when accessing the affected assets. This flaw can result in serious security implications, including session hijacking and unauthorized actions performed under the guise of legitimate users, compromising sensitive information and application integrity.

References