CVE-2026-94150: Omega Solution HRM OS SVG File Upload view cross site scripting
A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
An attacker needs high privileges and user interaction, according to the provided vector. The attack can be initiated remotely, and public exploit material is available.
Which deployments are in scope?
Omega Solution HRM OS versions up to 20260717 are identified as affected. The issue is associated with the SVG File Upload view at /media/view/.
What is the impact if exploitation succeeds?
The issue enables cross-site scripting and can affect integrity. No confidentiality or availability impact is indicated by the supplied severity vector.
Is a vendor fix available?
The provided data does not identify a fix. It states that the vendor was contacted but did not respond.