CVE-2026-91922 — Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render
Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query pa…
Published: 2026-09-15 · CVSS: 5.3 · CVSS 4.0
Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaApi or data parameters to execute arbitrary JavaScript in victim sessions and steal X-Auth-Token credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7