Steedos vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Steedos products: 1 record(s), with severity, exploitation and fixes.

Steedos-platform 1

Exploited only (KEV) →

CVE-2026-91922 Medium · 6.1 CWE-79 Sep 15, 2026

Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaApi or data parameters to execute arbitrary JavaScript in victim sessions and steal X-Auth-Token credentials.