MEDIUM 6.1 NVD
CVE-2026-121578
Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored
Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading to account takeover or code execution.
References
- https://github.com/Kuri119/Stored-XSS-In-Tactical-RMM-1.5.2/tree/main
- https://github.com/amidaware/tacticalrmm-web/commit/ba5363ea99cf776511e5c828b6d744e4d0bddd
- https://github.com/Kuri119/Stored-XSS-In-Tactical-RMM-1.5.2/tree/main
This medium severity vulnerability with a CVSS score of 6.1 was published on 2026-11-03 via NVD.
vulnfeed aggregates 18261 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.