JiLi Tech Enterprise Cloud DB XSS and Arbitrary File Upload Vulnerabilities (CVE-2026-15552, CVE-2026-15553)

Vulnerability Overview Vulnerability Name: Immediate Tech TVN ID: TVN-202607003 CVE ID: CVE-2026-15552, CVE-2026-15553 CVSS Score: - CVE-2026-15552: 6.1 (Medium) CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVE-2026-15553: 5.3 (Medium) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products Affected Product: Enterprise Cloud Database Description: - CVE-2026-15552 (Stored Cross-Site Scripting): Unauthenticated remote attackers can inject persistent JavaScript code into specific pages, which executes automatically when users browse the page. - CVE-2026-15553 (Arbitrary File Upload): Unauthenticated remote attackers can upload malicious programs for users to download. Remediation Solution: No action is required for the online version; private host versions need to be updated to a patch released on or after April 10, 2026. Additional Information Reporter: VickeyTsai, Tsai Ya-yi (Amper Information Technology Corp.) Public Disclosure Date: 2026-07-13 Related Links 1. CVE-2026-15552 2. CVE-2026-15553 Footer Information Last Updated: 2026-07-13 Total Views: 29,842,350 Contact Information E-mail: - TWCERT/CC Service Desk: cert_service(at)cert.org.tw - Corporate Security Incident Reporting Desk: int_report(at)cert.org.tw - CVE Reporting Desk: cve(at)cert.org.tw PGP KEY TWCERT/CC PGP Public Key Key ID: 0x1E9D1F1B Others TLP:CLEAR Recommended Browser Resolution: 1024x768 or higher Copyright Information Copyright © TWCERT/CC Taiwan Computer Network Emergency Response and Coordination Center 1998-2025 Social Media Links Facebook, YouTube, Instagram, RSS QR Code TWCERT/CC Taiwan Computer Network Emergency Response and Coordination Center Legal Statement Privacy Policy and Security Policy User Instructions Summary This page primarily introduces two vulnerabilities (CVE-2026-15552 and CVE-2026-15553) in Immediate Tech's Enterprise Cloud Database, involving Stored Cross-Site Scripting (XSS) and Arbitrary File Upload attacks, respectively. The affected scope includes all users of the product. The remediation is for private host users to update to a version released after April 10, 2026. The page also provides information on the vulnerability reporter, public disclosure date, related links, contact information, and PGP key.

Goal Reached Thanks to every supporter — we hit 100%!

JiLi Tech Enterprise Cloud DB XSS and Arbitrary File Upload Vulnerabilities (CVE-2026-15552, CVE-2026-15553)