Post by Offensive Sequence · Inkwell · Inkwell

Offensive Sequence

🌐@offseq@infosec.exchange·Thursday, March 19, 2026

1 min read

🚨 OpenProject CRITICAL XSS (CVE-2026-32703): Attackers with repo push access can inject persistent scripts via filenames, impacting all users viewing affected pages. Patch to 16.6.9/17.0.6/17.1.3/17.2.1+ now! https://radar.offseq.com/threat/cve-2026-32703-cwe-79-improper-neutralization-of-i-f2afc489 #OffSeq #XSS #OpenProject #infosec

Critical threat: CVE-2026-32703: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scr

radar.offseq.comCVE-2026-32703: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in opf openproject - Live Threat Intelligence - Threat Radar | OffSeq.comDetailed information about CVE-2026-32703: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in opf openproject affecOffSeq Threat Intelligence · 2026-03-18T21:04:16.982Zradar.offseq.com

#offseq #xss #openproject #infosec

🌐View on infosec.exchange →

Marginalia