CVE-2026-40126— DOM-based Cross-Site Scripting in OutSystems Service Center
Possible ATT&CK Techniques 1AI
T1059.007 · JavaScriptAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| OutSystems | Service Center | < 11.41.2 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-40126
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
DOM-based Cross-Site Scripting in OutSystems Service Center
Source: CVE Program / CVE List V5
Vulnerability Description
OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting (XSS) attack that can be exploited by a low-privileged attacker via the upload of a file with a malicious filename containing JavaScript code. The vulnerability exists in all locations where a file can be attached and prepared for upload to the server. This issue was fixed in OutSystems Service Center version 11.41.2
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Outsystems Service Center 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Outsystems Service Center是美国Outsystems公司的一个应用服务器运维管理平台。 Outsystems Service Center 11.41.2之前版本存在跨站脚本漏洞，该漏洞源于基于DOM的跨站脚本，低权限攻击者可通过上传包含JavaScript代码的恶意文件名的文件进行利用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| OutSystems | Service Center | 0 ~ 11.41.2 | - |
II. Public POCs for CVE-2026-40126
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-40126
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-40126 (1)
- 🔗 Vulnerability in OutSystems Service Center software | CERT Polska Read full article third-party-advisory
Vendor Pages for CVE-2026-40126 (1)
Other References for CVE-2026-40126 (1)
- 🔗 Not Found | OutSystemsvendor-advisory
IV. Related Vulnerabilities
Same weakness: CWE-79
- CVE-2026-78060
SourceCodester Stock Management System getOrderReport.php cr - CVE-2026-78059
SourceCodester Stock Management System printOrder.php cross - CVE-2026-78055
SourceCodester Class and Exam Timetabling System BSIT2.php c - CVE-2026-78054
SourceCodester Class and Exam Timetabling System BSIS1.php c - CVE-2026-77027
Joomla Extension - fabrikar.com - Unauthenticated stored XSS
V. Comments for CVE-2026-40126
No comments yet