PT-2026-3259 · Pem · Pem

CVE-2026-0949 · Publicado 2026-01-16 · Atualizado 2026-02-10

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions PEM versions prior to 9.8.1

Description PEM versions before 9.8.1 have a stored Cross-site Scripting (XSS) issue. A user with access to the Manage Charts menu can inject arbitrary JavaScript when creating a new chart. This JavaScript is then executed when any user accesses the chart. Access to the Manage Charts menu is, by default, limited to the superuser and users with pem admin or pem super admin privileges.

Recommendations Update to PEM version 9.8.1 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-0949

Produtos afetados

Pem

Referências · 5

• https://osv.dev/vulnerability/CVE-2026-0949 · Aviso do Fabricante
• https://t.me/cveNotify/151584 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-0949 · Nota de Segurança
• https://enterprisedb.com/docs/security/advisories/cve20260949 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2012303241565061632 · Publicação no Twitter