CVE-2026-4313

Stored XSS in AdaptiveGRC

State: Published
Severity: 2.4 Low
Published: Apr 24, 2026
Updated: Apr 24, 2026
Reserved: Mar 17, 2026

Description

AdaptiveGRC is vulnerable to Stored XSS via text type fields across the forms. Authenticated attacker can replace the value of the text field in the HTTP POST request. Improper parameter validation by the server results in arbitrary JavaScript execution in the victim's browser. Critically, this may allow the attacker to obtain the administrator authentication token and perform arbitrary actions with administrative privileges, which could lead to further compromise.

This issue occurs in versions released before December 2025.

Scores

CVSS	Score	Vector	Source
4.0	2.4 Low	CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N	CERT-PL

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Affected Products

Product	Versions
AdaptiveGRCC&F	5.420.00 to before 5.420.66Affected 5.420.00 to before 5.444.119Affected 5.420.00 to before 5.448.116Affected 5.420.00 to before 5.453.110Affected 5.420.00 to before 5.454.64Affected 5.420.00 to before 5.455.87Affected 5.420.00 to before 5.456.60Affected 5.420.00 to before 5.499.113Affected
AdaptiveGRCC&F	5.420.00 to before 5.420.14Affected 5.420.00 to before 5.423.7Affected 5.420.00 to before 5.444.20Affected 5.420.00 to before 5.448.42Affected 5.420.00 to before 5.449.40Affected 5.420.00 to before 5.453.19Affected 5.420.00 to before 5.454.17Affected 5.420.00 to before 5.456.20Affected

References

https://cert.pl/posts/2026/04/CVE-2026-4313third-party-advisory
https://adaptivegrc.com/pl/wszystkie-procesy-grc-w-jednym-narzedziu/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.