CVE-2026-113808: Stored XSS on SNS Enrollment Portal

Published Oct 20, 2026

Updated

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal.

Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator.

Affected Software

1 affected component

SNS Enrollment Portal

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SNS to a version that resolves this vulnerability.
Fixed in 4.3.45 QS
Upgrade
Upgrade SNS to a version that resolves this vulnerability.
Fixed in 4.8.20 LSTB
Upgrade
Upgrade SNS to a version that resolves this vulnerability.
Fixed in 5.0.10
Upgrade
Upgrade SNS to a version that resolves this vulnerability.
Fixed in 5.1.4 EA

Event History

Oct 20, 2026

CVE Published

via MITRE·06:15 PM

Data Sourced

via MITRE·06:15 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who must interact with the malicious content for the XSS to execute?

An administrator must trigger the stored payload during validation of a user-creation request. The vulnerability is not described as executing merely when the attacker submits the request.

What access does an attacker need to submit the payload?

The attacker needs access to the captive portal and must be able to request user creation. No authentication requirement is stated in the provided data.

CVE-2026-113808: Stored XSS on SNS Enrollment Portal

Affected Software

Remediation

Event History

Frequently Asked Questions

Who must interact with the malicious content for the XSS to execute?

What access does an attacker need to submit the payload?

Company

Resources

Contact

Frequently Asked Questions

Who must interact with the malicious content for the XSS to execute?

What access does an attacker need to submit the payload?