Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

eBA Plus can let attackers inject malicious scripts

CVE-2026-82969 · published 1 month ago
Summary

The eBA Plus document and workflow system (versions 6.7.141 up to but not including 10.0.11) does not properly remove dangerous code when it creates web pages. An attacker could store harmful scripts that run in a user's browser, potentially stealing data or changing what the user sees. Update to version 10.0.11 or later, or apply the vendor's fix, to protect your system.

What to do
  • Update bimser solution software trade inc. eba plus document and workflow management system to version 10.0.11 or later.
Affected software
VendorProductAffected versions
bimser solution software trade inc. eba plus document and workflow management system < 10.0.11
Original advisory text
Stored XSS in BİMSER's eBA Plus
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Stored XSS.

This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.11.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published28 Sep 2026
Updated26 Oct 2026
First seen28 Sep 2026
Sources
CVE-2026-82969 · NVD
CVE-2026-82969 · MITRE
Track software like this
Free during beta