Vulnerability Report

CVE-2026-1008

Title: Stored XSS in Altium 365 User Profile Text Fields

XSS

Proof Of Concept

No public PoC currently indexed for CVE-2026-1008.

CWE Category CWE-79

Published Date Jan 15, 2026

Modified Date Jan 23, 2026

Exploit Status Not Found

Score 7.6 CVSS v3.1

Exploit Probability (EPSS)

0.21%

Vulnerability Summary

CVE-2026-1008: A stored cross-site scripting (XSS) vulnerability exists in the user profile text fields of Altium 365. Insufficient server-side input sanitization allows authenticated users to inject arbitrary HTML and JavaScript payloads using whitespace-based attribute parsing bypass techniques. The injected payload is persisted and executed when other users view the affected profile page, potentially allowing session token theft, phishing attacks, or malicious redirects. Exploitation requires an authenticated account and user interaction to view the crafted profile.

Impacted Vendors

altium 1

Reference Links

https://www.altium.com/platform/security-compliance/security-advisories

CVSS v3.1

Source Entity [email protected]

Severity MEDIUM

5.4

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N