CVE-2026-71189

Toptech TMS7 and TopHAT Cross-site Scripting

CVSS 4.8 medium · Toptech Systems TMS7 · published 2026-09-29

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

NVD · CVE.org

Coverage 1 source

1. 2026-09-29 CISA Cybersecurity Advisories high Toptech TMS7 and TopHAT

   Multiple vulnerabilities affect Toptech TMS7 and TopHAT versions 7.6.3.

Mentioned with

CVE-2026-63713 CVE-2026-68068 CVE-2026-68954 CVE-2026-69662 CVE-2026-70356 CVE-2026-71302 CVE-2026-71379 CVE-2026-72507 CVE-2026-72510

Also covered

• CVE-2026-88771 A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands CVSS 9.5 · 4 articles · 2026-09-29
• CVE-2026-91191 Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature CVSS 7.7 · 1 article · 2026-09-29
• CVE-2026-86950 Apple iOS and iPadOS CVSS 8.8 · 2 articles · 2026-09-29
• CVE-2026-84409 Lantronix G520 Series Cellular Gateway Cross-site Scripting CVSS 7.7 · 1 article · 2026-09-29
• CVE-2026-72510 Toptech TMS7 and TopHAT SQL Injection CVSS 8.5 · 1 article · 2026-09-29