CVE-2026-79035: XSS
Published Sep 11, 2026
·Updated
A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted URL into the ca parameter.
Affected Software
1 affected component
Zeta Marketing Platform (ZMP)=1.0
Event History
Sep 11, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What must an attacker do to exploit this issue?
An attacker must cause a victim to visit a crafted URL that injects JavaScript through the ca parameter of the p.rfihub.com component.
2
Who is exposed to the attack?
Users whose browsers can be induced to open the crafted URL are exposed, because the injected JavaScript executes in the victim's browser context.
3
How can teams check whether they are affected?
Review handling of the ca parameter in the p.rfihub.com component and test whether crafted URL input is reflected into responses without safe output encoding.