CVE-2026-1469

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-1469
Stored Cross-Site Scripting (XSS) in RLE NOVA's PlanManager. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting malicious payload through the ‘comment’ and ‘brand’ parameters in ‘/index.php’. The payload is stored by the application and subsequently displayed without proper sanitization when other users access it. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-rle-novas-planmanager Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:nova-a:planmanager:-:*:*:*:*:*:*:*
History

09 Mar 2026, 14:16

Type Values Removed Values Added
References () https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-rle-novas-planmanager - () https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-rle-novas-planmanager - Third Party Advisory
Summary
  • (es) Cross-Site Scripting (XSS) Almacenado en el PlanManager de RLE NOVA. Esta vulnerabilidad permite a un atacante ejecutar código JavaScript en el navegador de la víctima inyectando una carga útil maliciosa a través de los parámetros 'comment' y 'brand' en '/index.PHP'. La carga útil es almacenada por la aplicación y posteriormente mostrada sin la sanitización adecuada cuando otros usuarios acceden a ella. Esta vulnerabilidad puede ser explotada para robar datos sensibles del usuario, como cookies de sesión, o para realizar acciones en nombre del usuario.
CPE cpe:2.3:a:nova-a:planmanager:-:*:*:*:*:*:*:*
First Time Nova-a
Nova-a planmanager
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4

29 Jan 2026, 12:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-29 12:16

Updated : 2026-03-09 14:16

NVD link : CVE-2026-1469

Mitre link : CVE-2026-1469

CVE.ORG link : CVE-2026-1469

JSON object : View

Products Affected

nova-a

  • planmanager
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')