CVE Intelligence

Steedos Steedos-platform vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Steedos Steedos-platform: 1 record(s), with affected versions and fixes.

CVE-2026-91922 Medium · 6.1 CWE-79 Sep 15, 2026
Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render
Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaApi or data parameters to execute arbitrary JavaScript in victim sessions and steal X-Auth-Token credentials.