CVE-2026-28297— SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-28297
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
SolarWinds Observability Self-Hosted 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SolarWinds Observability Self-Hosted是美国SolarWinds公司的一款观察平台。 SolarWinds Observability Self-Hosted存在跨站脚本漏洞，该漏洞源于存储型跨站脚本漏洞，可能导致意外脚本执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SolarWinds | SolarWinds Observability Self-Hosted | 2026.1.1 and previous versions | - |
II. Public POCs for CVE-2026-28297
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-28297
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: SolarWinds Observability Self-Hosted
- CVE-2026-28298
SolarWinds Observability Self-Hosted Stored Cross-Site Scrip - CVE-2025-40545
SolarWinds Observability Self-Hosted Open Redirection Vulner - CVE-2025-26391
SolarWinds Observability Self-Hosted XSS Vulnerability - CVE-2025-26397
SolarWinds Observability Self-Hosted Deserialization of Untr - CVE-2025-26395
SolarWinds SWOSH DOM-based reflective XSS Vulnerability
Same vendor: SolarWinds
- CVE-2026-28298
SolarWinds Observability Self-Hosted Stored Cross-Site Scrip - CVE-2025-40541
SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Re - CVE-2025-40540
SolarWinds Serv-U Type Confusion Remote Code Execution Vulne - CVE-2025-40539
SolarWinds Serv-U Type Confusion Remote Code Execution Vulne - CVE-2025-40538
SolarWinds Serv-U Broken Access Control Remote Code Executio
Same weakness: CWE-79
- CVE-2026-8262
Devs Palace ERP Online chart-save cross site scripting - CVE-2026-8256
Devs Palace ERP Online mr-save cross site scripting - CVE-2026-8255
Devs Palace ERP Online add_new_customer cross site scripting - CVE-2026-8254
Devs Palace ERP Online sales_save cross site scripting - CVE-2026-8253
Devs Palace ERP Online purchase_save cross site scripting
V. Comments for CVE-2026-28297
No comments yet