Post by Offensive Sequence · Inkwell · Inkwell

Offensive Sequence

🌐@offseq@infosec.exchange·Thursday, March 19, 2026

1 min read

⚠️ CRITICAL: CVE-2026-32703 in OpenProject (<16.6.9, <17.0.6, <17.1.3, <17.2.1) enables persistent XSS via repo filenames. Attackers w/ push access can inject scripts — risk: session hijack, data theft. Patch now! https://radar.offseq.com/threat/cve-2026-32703-cwe-79-improper-neutralization-of-i-f2afc489 #OffSeq #XSS #OpenProject #Vuln

Critical threat: CVE-2026-32703: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scr

radar.offseq.comCVE-2026-32703: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in opf openproject - Live Threat Intelligence - Threat Radar | OffSeq.comDetailed information about CVE-2026-32703: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in opf openproject affecOffSeq Threat Intelligence · 2026-03-18T21:04:16.982Zradar.offseq.com

#offseq #xss #openproject #vuln

🌐View on infosec.exchange →

Marginalia