XSS in Mycomplianceoffice Mco
CVE-2026-53907
MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via the application logo upload functionality. An attacker with the ability to change the application logo can upload a crafted SVG file containing malicious JavaScript code that is ex…
Vulnerability class: XSS (Cross-Site Scripting)
Affected products
- Mycomplianceoffice Mco — versions 25.3.3.1
Weakness classification (CWE)
References
- cvd@cert.pl (third-party-advisory)
- cvd@cert.pl (product)