PT-2026-5261 · Rle Nova · Rle Nova Planmanager

Fenix08 · Published 2026-01-29 · Updated 2026-03-09 · CVE-2026-1469

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions RLE NOVA PlanManager (affected versions not specified)

Description A stored Cross-Site Scripting (XSS) issue exists in RLE NOVA's PlanManager. An attacker can inject malicious JavaScript code through the comment and brand parameters in the '/index.php' endpoint. The application stores this payload and displays it to other users without proper sanitization, potentially allowing the attacker to steal sensitive user data, like session cookies, or perform actions as the user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-1469

Affected Products

Rle Nova Planmanager

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-1469 · Security Note
• https://twitter.com/VulmonFeeds/status/2016852747711025210 · Twitter Post
• https://t.me/cveNotify/154797 · Telegram Post
• https://twitter.com/incibe_cert/status/2016833068208714004 · Twitter Post
• https://t.me/CVEtracker/43229 · Telegram Post
• https://twitter.com/CVEnew/status/2016854775971860928 · Twitter Post
• https://t.me/cveNotify/150257 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-rle-novas-planmanager · Note