Vulnerability · Published Sep 21, 2026 · Assigned by VulDB

CVE-2026-94150Omega Solution HRM OS SVG File Upload view cross site scripting

Low 2.4

In plain English

A low-severity cross-site scripting in HRM OS from Omega Solution. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)2.4Low

Exploit odds (30 days)0.4%top 71.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Omega Solution	HRM OS	20260717

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-408064 | Omega Solution HRM OS SVG File Upload view cross site scripting vdb-entry
VDB-408064 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-94150 | CVE Analysis and Report third-party-advisory
Submit #894310 | Omega Solution HRM OS Latest Cross Site Scripting third-party-advisory
https://github.com/4m3rr0r/PoCVulDb/issues/21 exploit, issue-tracking