Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-0949

PEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting (XSS) vulnerability that allows users with access to the Manage Charts menu to inject arbitrary JavaScript

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
EDB

Description

PEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting (XSS) vulnerability that allows users with access to the Manage Charts menu to inject arbitrary JavaScript when creating a new chart, which is then executed by any user accessing the chart. By default only the superuser and users with pem_admin or pem_super_admin privileges are able to access the Manage Charts menu.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

EnterpriseDB Postgres Enterprise Manager (PEM)

Default version status: affected

  • 9 to < 9.8.1affected

References