CVE-2026-7172
Received Received - Intake

Stored XSS in TPVEnlanube User List

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7172: parameter 'Nombre Completo' in the endpoint  '/administrator/index.php?option=com_virtuemart&page=admin.user_list'. Successful exploitation of this vulnerability could allow an authenticated attacker to inject malicious code and execute it in users' browsers without their consent.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-7172
EUVD
EUVD-2026-88200

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
virtuemart virtuemart *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in TPVEnlanube affecting the 'Nombre Completo' parameter in the '/administrator/index.php?option=com_virtuemart&page=admin.user_list' endpoint. An authenticated attacker can inject malicious code that executes in users' browsers without their consent.

Detection Guidance

This vulnerability is a Stored XSS in TPVEnlanube affecting the 'Nombre Completo' parameter in the '/administrator/index.php?option=com_virtuemart&page=admin.user_list' endpoint. Detection requires manual inspection of user input handling in this specific parameter and endpoint.

Impact Analysis

An attacker could steal user sessions, deface web pages, or perform actions on behalf of users. This could lead to unauthorized access to sensitive data or account takeovers if users interact with the injected script.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may risk protected health information exposure if exploited in healthcare systems.

Mitigation Strategies

Update TPVEnlanube to the latest patched version. Validate and sanitize all user inputs, especially the 'Nombre Completo' parameter in the specified endpoint. Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7172. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart