EUVD Vulnerability Catalog
EUVD-2026-82863
Severity: MEDIUM
Base Score: 5.1
CVSS Version: 4.0
Vulnerability Description
A stored Cross-Site Scripting (XSS) vulnerability in the profile management functionality of T-Systems’ TAO 2.0 suite. An authenticated user could inject malicious HTML or JavaScript content into the fields containing their personal data. The content entered is stored and displayed without being properly sanitised when another user, including administrative staff, views the affected profile. Successful exploitation could allow JavaScript code to be executed in the victim’s browser, access to information available within the session, or the performance of actions using the victim’s permissions.
CVSS Vector Analysis
Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
▪
Attack Vector (AV): Network
▪
Attack Complexity (AC): Low
▪
Attack Requirements (AT): None
▪
Privileges Required (PR): Low
▪
User Interaction (UI): Passive
▪
Vulnerability Confidentiality Impact (VC): None
▪
Vulnerability Integrity Impact (VI): None
▪
Vulnerability Availability Impact (VA): None
▪
Subsequent Confidentiality Impact (SC): Low
▪
Subsequent Integrity Impact (SI): Low
▪
Subsequent Availability Impact (SA): None
Affected Vendors & Systems
Vendor
T-Systems
References & Advisory Links
Metadata Profile
Database Authority
European Union Agency for Cybersecurity (ENISA) EUVD
Assigner
INCIBE
EPSS Probability
0.27
Known Aliases
GHSA-f95c-wf66-hq9m
CVE-2026-92976
Published On
2026-09-18
Last Updated
2026-09-18