CVE-2026-18741

Received Received - Intake

Stored XSS in Worksuite SaaS Asset Management Module

Publication date: 2026-08-13

Last updated on: 2026-08-14

Assigner: VulnCheck

Description

Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset. Attackers can store crafted HTML script tags in the application database that execute automatically in the browsers of any user who views the affected asset, potentially leading to session hijacking, credential theft, and unauthorized actions on behalf of authenticated users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-14

Generated

2026-09-03

AI Q&A

2026-08-14

EPSS Evaluated

2026-09-02

NVD

CVE-2026-18741

Affected Vendors & Products

Vendor	Product	Version / Range
worksuite	worksuite	to 6.0.14 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in Worksuite SaaS versions before 6.0.14. It exists in the Asset Management module where authenticated administrators can inject malicious JavaScript by entering harmful payloads into the Location and Description fields when creating a new asset. The injected scripts are stored in the database and executed automatically in the browsers of users viewing the affected asset.

Detection Guidance

Check Worksuite SaaS versions prior to 6.0.14 for stored XSS in the Asset Management module. Inspect Location and Description fields of assets for malicious JavaScript payloads, particularly HTML script tags. Review database entries for suspicious HTML content.

Impact Analysis

This vulnerability can lead to session hijacking, credential theft, and unauthorized actions performed by attackers on behalf of authenticated users. Attackers could steal session tokens, impersonate users, or perform actions without consent, potentially compromising sensitive data or system integrity.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosures, or loss of control over personal or health information, potentially leading to legal penalties and compliance failures.

Mitigation Strategies

Upgrade Worksuite SaaS to version 6.0.14 or later. Implement input validation to block script tags in Location and Description fields. Monitor asset entries for unauthorized changes and remove any detected malicious payloads.

Hi! I’m here to help you understand CVE-2026-18741. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70