Vulnerability record/PUBLISHED/Published Nov 9, 2026 10:27:49 UTC
CVE-2026-123766
Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding, allowing script injection in the context of the Axis2 origin. This issue affects Apache Axis2/Java: 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityapache
Last updatedNov 9, 2026 11:08:58 UTC
PublishedNov 9, 2026 10:27:49 UTC
ReservedNov 6, 2026 13:54:13 UTC
Credits
- n0mi1k