GCVE-110-NCSC-2026-436

Advisory PublishedCVSS 8.7/10

Vulnetix · Advisory published October 16, 2026

Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability that permits attackers to inject malicious scripts into form fields, enabling execution of arbitrary JavaScript in users' browsers and potential account or session compromise.

Download JSON Open in Console

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-1336Improper Neutralization of Special Elements Used in a Template EngineCWE-863Incorrect Authorization

Risk Scores

CVSS 3.1

8.7/10

High · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
Adobe	vers:unknown/*	—	—

Aliases

CVE-2026-100133 CVE-2026-103849 CVE-2026-75650 CVE-2026-91013 CVE-2026-92464 CVE-2026-92908 CVE-2026-92909 CVE-2026-92910 CVE-2026-92911 CVE-2026-92922 CVE-2026-95630 CVE-2026-95631

References

advisory

Browse GCVE Records

5,487 records in the GCVE database · Updated October 16, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON