Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

PcVue OAuth Error Page Allows Remote Code Injection

CVE-2026-1695 · published 8 months ago
Summary

A security flaw in PcVue's OAuth error page could allow an attacker to trick users into visiting a malicious website. This only affects certain features of PcVue, including WebVue, WebScheduler, TouchVue, and SnapVue, and can be mitigated by updating to a patched version.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
arcinformatique pcvue >= 12.0.0, <= 15.2.13
>= 16.0.0, < 16.3.4
cpe:2.3:a:arcinformatique:pcvue:*:*:*:*:*:*:*:*
Original advisory text
An XSS vulnerability affects the OAuth web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attac...
An XSS vulnerability affects the OAuth web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to trick a legitimate user into loading content from another site upon unsuccessful user authentication on an unknown application (unknown client_id).

This vulnerability only affects the error page of the OAuth server.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published26 Feb 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2026-1695 · NVD
Track software like this
Free during beta