What is CVE-2026-26460?

CVE-2026-26460 is a medium-severity vulnerability in N/a, classified under Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). CVSS score: 6.1/10. Published 2026-04-13.

How severe is CVE-2026-26460?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in N/a

CVE-2026-26460

A HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0. The application fails to properly neutralize user-supplied input in the tabid parameter of the DashBoardTab view (getTabContents action), allowing an attacker to inject arbitrary HTML content into the dashboard interface. The injected content is rendered in the victim's browser

EPSS: 0.002 (6.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

N/a — versions n/a

Weakness classification (CWE)

CWE-80 — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

References

Frequently asked questions

What is CVE-2026-26460?: CVE-2026-26460 is a medium-severity vulnerability in N/a, classified under Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). CVSS score: 6.1/10. Published 2026-04-13.
How severe is CVE-2026-26460?: Medium severity. CVSS v3 base score is 6.1 out of 10.