Vulnerability · Published Aug 13, 2026 · Assigned by VulnCheck
CVE-2026-18741Worksuite SaaS version prior to 6.0.14 Stored XSS via Asset Management Location and Description Fields
Medium 4.8
In plain English
A medium-severity cross-site scripting in Worksuite SaaS from Froiden. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset. Attackers can store crafted HTML script tags in the application database that execute automatically in the browsers of any user who views the affected asset, potentially leading to session hijacking, credential theft, and unauthorized actions on behalf of authenticated users.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Froiden | Worksuite SaaS | 0 – before 6.0.14 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N