Log in Start free

Vulnerability · Published Apr 24, 2026 · Assigned by CERT-PL

CVE-2026-4313Stored XSS in AdaptiveGRC

Low 2.4

In plain English

A low-severity cross-site scripting in AdaptiveGRC from C&F. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 4.0)2.4Low
Exploit odds (30 days)0.6%top 51.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

AdaptiveGRC is vulnerable to Stored XSS via text type fields across the forms. Authenticated attacker can replace the value of the text field in the HTTP POST request. Improper parameter validation by the server results in arbitrary JavaScript execution in the victim's browser. Critically, this may allow the attacker to obtain the administrator authentication token and perform arbitrary actions with administrative privileges, which could lead to further compromise. This issue occurs in versions released before December 2025.

Affected products (as reported)

VendorProductVersions
C&F AdaptiveGRC 5.420.00 – before 5.420.665.420.00 – before 5.444.1195.420.00 – before 5.448.1165.420.00 – before 5.453.1105.420.00 – before 5.454.645.420.00 – before 5.455.875.420.00 – before 5.456.605.420.00 – before 5.499.113
C&F AdaptiveGRC 5.420.00 – before 5.420.145.420.00 – before 5.423.75.420.00 – before 5.444.205.420.00 – before 5.448.425.420.00 – before 5.449.405.420.00 – before 5.453.195.420.00 – before 5.454.175.420.00 – before 5.456.20

Weakness: CWE-79 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

References