CVE-2026-7171
Received Received - Intake

Stored XSS in TPVEnlanube User Management

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7171: parameter 'Apellido 1' in the endpoint  '/administrator/index.php?page=admin.user_add&user_id=45&option=com_virtuemart'. Successful exploitation of this vulnerability could allow an authenticated attacker to inject malicious code and execute it in users' browsers without their consent.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-7171
EUVD
EUVD-2026-88201

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in TPVEnlanube. It affects the 'Apellido 1' parameter in the '/administrator/index.php?page=admin.user_add&user_id=45&option=com_virtuemart' endpoint. An authenticated attacker can inject malicious code that executes in users' browsers without their consent.

Detection Guidance

This vulnerability is specific to TPVEnlanube and involves a stored XSS in the 'Apellido 1' parameter of the '/administrator/index.php?page=admin.user_add&user_id=45&option=com_virtuemart' endpoint. Detection requires manual inspection of input handling in this parameter or monitoring for suspicious script injections in user profiles.

Impact Analysis

An attacker could steal user sessions, deface web pages, or perform actions on behalf of users. This could lead to unauthorized access to sensitive data or account takeovers if users interact with the injected script.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may compromise protected health information if exploited in healthcare systems.

Mitigation Strategies

Immediately update TPVEnlanube to the latest patched version. If no patch is available, restrict access to the vulnerable endpoint to trusted users only and implement input validation for the 'Apellido 1' parameter to block script tags and other XSS payloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7171. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart