CVE-2026-119680

HOCH 8.5CVE-2026-119680 · Published 30/10/2026 · updated 06/11/2026

Kurz gesagt

CVE-2026-119680 ist eine Schwachstelle (HOCH (CVSS 8.5)).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.24%, höher als bei 15.2% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full names, site names, or group names. The injected content is stored and subsequently executed in the context of other users' browsers when the affected charts are rendered. This vulnerability was fixed in client application build 4508.

References

pitstop.manageengine.com/portal/en/community/topic/sharepoint-manager-plus-build-4508-is-here

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free