CVE-2026-75170: XSS
Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1) allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require authentication or prior access?
No. A remote unauthenticated attacker can exploit the issue by supplying a crafted value in the language POST parameter to the /loginController/doLogin endpoint.
Which deployment is identified as affected?
The reported affected product is HubCore platform version 14.1.1. The provided information does not identify other affected versions or configuration-specific prerequisites.
How can I assess exposure?
Check whether your HubCore instance runs version 14.1.1 and exposes the /loginController/doLogin endpoint. The issue is associated specifically with handling of the language POST parameter in that endpoint.