CVE-2026-113383
Received Received - Intake

Cross-Site Scripting in OptimalCloud 5.0 via Login Page

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulDB

Description
A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113383
EUVD
EUVD-2026-104930

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Optimal IdM OptimalCloud 5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) flaw in Optimal IdM OptimalCloud 5.0. It exists in the /v5.0/webapps/pages/public/Login file where the 'tz' argument can be manipulated to inject malicious scripts. This allows attackers to execute arbitrary code in a victim's browser.

Detection Guidance

This vulnerability involves a reflected cross-site scripting (XSS) flaw in OptimalCloud 5.0 via the 'tz' parameter in /v5.0/webapps/pages/public/Login. To detect it, inspect HTTP requests to this endpoint for the 'tz' parameter containing script tags or JavaScript code. Use tools like curl to send test payloads such as <script>alert(1)</script> in the 'tz' parameter and check for reflected output in responses.

Impact Analysis

An attacker could exploit this to steal session cookies, redirect users to malicious sites, or perform actions on behalf of users. It may lead to unauthorized access to sensitive data or account takeover if exploited.

Compliance Impact

This XSS vulnerability could violate GDPR by exposing user data or HIPAA by compromising protected health information. It may lead to non-compliance with data protection requirements due to unauthorized access risks.

Mitigation Strategies

Immediately update OptimalCloud to the latest version if a patch is available. If no patch exists, implement input validation to sanitize the 'tz' parameter, blocking or escaping script tags and JavaScript code. Use a web application firewall (WAF) to filter malicious payloads. Disable or restrict access to the affected endpoint if possible until mitigation is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113383. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart