CVE-2026-105099
Received Received - Intake

Cross-Site Scripting in Omega Solution CoinEx Crypto 2025

Publication date: 2026-10-04

Last updated on: 2026-10-04

Assigner: VulDB

Description
A weakness has been identified in Omega Solution CoinEx Crypto 2025. Affected by this vulnerability is an unknown functionality of the file /user/ticket of the component Ticket Attachment Upload. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The product web site does not exist anymore. Maybe the product got retired and/or replaced. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-04
Last Modified
2026-10-04
Generated
2026-10-04
AI Q&A
2026-10-04
EPSS Evaluated
N/A
NVD
CVE-2026-105099
EUVD
EUVD-2026-92070

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
omega_solution coinex_crypto 2025

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (Stored XSS) issue in Omega Solution CoinEx Crypto 2025. It allows authenticated users to upload SVG files containing malicious JavaScript. The application fails to sanitize these files, enabling embedded scripts to execute when viewed by others. SVG files support active content like scripts and event handlers, which the application does not block.

Detection Guidance

To detect this vulnerability, inspect uploaded SVG files in the ticket system for embedded JavaScript or event handlers like <script> or onload attributes. Check server logs for unusual requests to /user/ticket. Use tools like OWASP ZAP or Burp Suite to scan for stored XSS in the ticket attachment upload functionality.

Impact Analysis

Attackers can exploit this to steal session cookies, perform actions as victims, read sensitive data, modify pages, redirect users, or escalate privileges if administrators view malicious tickets. The impact depends on user roles and permissions within the application.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, non-compliance with privacy regulations, and potential legal consequences for organizations failing to protect user data.

Mitigation Strategies

Disable SVG uploads in the ticket system. If SVG uploads are required, implement strict input validation to reject files containing executable content. Sanitize SVG files to remove scripts and event handlers. Apply a strict Content Security Policy (CSP) to limit XSS impact. Serve SVG files with secure headers to prevent script execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105099. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart