{"id":"CVE-2026-94150","state":"PUBLISHED","title":"Omega Solution HRM OS SVG File Upload view cross site scripting","description":"A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2026-09-21T08:00:10.826Z","updatedAt":"2026-09-24T13:21:14.192Z","severity":{"score":4.8,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["Omega Solution HRM OS"],"affected":[{"vendor":"Omega Solution","product":"HRM OS","versions":[{"version":"20260717","status":"affected"}],"cpes":["cpe:2.3:a:omega_solution:hrm_os:*:*:*:*:*:*:*:*"],"modules":["SVG File Upload"]}],"references":["https://vuldb.com/vuln/408064","https://vuldb.com/vuln/408064/cti","https://vuldb.com/cve/CVE-2026-94150","https://vuldb.com/submit/894310","https://github.com/4m3rr0r/PoCVulDb/issues/21"],"weaknesses":["CWE-79","CWE-94"],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/94xxx/CVE-2026-94150.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-94150","state":"PUBLISHED","datePublished":"2026-09-21T08:00:10.826Z","dateUpdated":"2026-09-24T13:21:14.192Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-09-20T21:30:51.214Z"},"containers":{"cna":{"title":"Omega Solution HRM OS SVG File Upload view cross site scripting","descriptions":[{"lang":"en","value":"A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"vendor":"Omega Solution","product":"HRM OS","versions":[{"version":"20260717","status":"affected"}],"cpes":["cpe:2.3:a:omega_solution:hrm_os:*:*:*:*:*:*:*:*"],"modules":["SVG File Upload"]}],"references":[{"url":"https://vuldb.com/vuln/408064","name":"VDB-408064 | Omega Solution HRM OS SVG File Upload view cross site scripting","tags":["vdb-entry"]},{"url":"https://vuldb.com/vuln/408064/cti","name":"VDB-408064 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-94150","name":"CVE-2026-94150 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/894310","name":"Submit #894310 | Omega Solution HRM OS Latest Cross Site Scripting","tags":["third-party-advisory"]},{"url":"https://github.com/4m3rr0r/PoCVulDb/issues/21","tags":["exploit","issue-tracking"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":4.8,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":2.4,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":2.4,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":3.3,"vectorString":"AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"Cross Site Scripting"}]},{"descriptions":[{"cweId":"CWE-94","type":"CWE","lang":"en","description":"Code Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-09-21T08:00:10.826Z"},"timeline":[{"time":"2026-09-20T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-09-20T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-09-20T23:36:09.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"4m3rr0r (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}],"x_generator":["VulDB PVTS v202609"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-24T13:21:03.865834Z","id":"CVE-2026-94150","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-24T13:21:14.192Z"}}]}}}