CVE-2026-82969: Stored XSS in BİMSER's eBA Plus

Q: Which deployments are affected?

Affected versions are eBA Plus Document and Workflow Management System versions from 6.7.141 before 10.0.11. Version 10.0.11 is not identified as affected by the supplied information.

Q: What level of access does an attacker need?

The vulnerability has a low-privileges-required rating (PR:L) and can be exploited remotely over the network (AV:N). No user interaction is required for exploitation (UI:N).

Q: What is the likely impact if exploited?

The supplied CVSS vector rates confidentiality and integrity impact as low, with no availability impact. Because this is stored XSS, malicious input may be retained and rendered in web pages.

Published Sep 28, 2026

Updated

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Stored XSS.

This issue affects eBA Plus Document and Workflow Management System: from 6.7.141 before 10.0.11.

Affected Software

1 affected component

Bimser eBA Plus Document and Workflow Management System>=6.7.141<10.0.11

Event History

Sep 28, 2026

CVE Published

via MITRE·08:24 AM

Data Sourced

via MITRE·08:24 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected versions are eBA Plus Document and Workflow Management System versions from 6.7.141 before 10.0.11. Version 10.0.11 is not identified as affected by the supplied information.

What level of access does an attacker need?

The vulnerability has a low-privileges-required rating (PR:L) and can be exploited remotely over the network (AV:N). No user interaction is required for exploitation (UI:N).

What is the likely impact if exploited?