PT-2026-3259 · Pem · Pem

Published 2026-01-16 · Updated 2026-02-10 · CVE-2026-0949

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions PEM versions prior to 9.8.1

Description PEM versions before 9.8.1 have a stored Cross-site Scripting (XSS) issue. A user with access to the Manage Charts menu can inject arbitrary JavaScript when creating a new chart. This JavaScript is then executed when any user accesses the chart. Access to the Manage Charts menu is, by default, limited to the superuser and users with pem admin or pem super admin privileges.

Recommendations Update to PEM version 9.8.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-0949

Affected Products

Pem

References · 5

• https://osv.dev/vulnerability/CVE-2026-0949 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-0949 · Security Note
• https://enterprisedb.com/docs/security/advisories/cve20260949 · Vendor Advisory
• https://t.me/cveNotify/151584 · Telegram Post
• https://twitter.com/CVEnew/status/2012303241565061632 · Twitter Post