CVE-2026-1469Disclosure(nova-a / planmanager)

LOWCVSS 5.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Stored Cross-Site Scripting (XSS) in RLE NOVA's PlanManager. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting malicious payload through the ‘comment’ and ‘brand’ parameters in ‘/index.php’. The payload is stored by the application and subsequently displayed without proper sanitization when other users access it. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.

nova-a CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-rle-novas-planmanager

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

planmanager

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 4 classified signals
Peaked 1d ago at 3 mentions (2026-01-29); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

nova-a

Products

planmanager

1 version affected across 1 product

Deep dive

Activity timeline4 mentions / 2d

Signal classification1 categories

Disclosure

4100.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-01-29	3	Disclosure3
2026-03-09	1	Disclosure1

Full discourse4 posts

CVE@CVEnew252d
Disclosure
CVE-2026-1469 Stored Cross-Site Scripting (XSS) in RLE NOVA's PlanManager. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting malic… https://www.cve.org/CVERecord?id=CVE-2026-1469
Post summary
The text announces CVE-2026-1469, describing it as a stored XSS vulnerability in RLE NOVA's PlanManager, with no evidence of PoC, exploit code, or active exploitation.
00010258
56.5K followersView on X
INCIBE-CERT@incibe_cert252d
Disclosure
⚠️#INCIBEaviso | Cross-Site Scripting (XSS) almacenado en PlanManager de #RLENOVA #CVE #CVE-2026-1469 https://www.incibe.es/incibe-cert/alerta-temprana/avisos/cross-site-scripting-xss-almacenado-en-planmanager-de-rle-nova #AvisosDeSeguridad #TI #CNA #0day https://t.co/C0Pk4Icw8F
Post summary
The tweet announces a stored XSS flaw (CVE‑2026‑1469) discovered in PlanManager of RLENOVA, referencing an INCIBE advisory link for details.
00010416
42.5K followersView on X
DailyCVE@dailycve213d
Disclosure
🟠 RLE NOVA PlanManager, Stored XSS, #CVE-2026-1469 (MEDIUM) https://dailycve.com/rle-nova-planmanager-stored-xss-cve-2026-1469-medium/
Post summary
A new stored XSS vulnerability (CVE‑2026‑1469) has been identified in RLE NOVA PlanManager, rated Medium severity. No exploit tools, patches, or active exploitation reports are provided.
0000030
166 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds252d
Disclosure
CVE-2026-1469 Stored Cross-Site Scripting Vulnerability in RLE NOVA PlanManager via Comment Parameters https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1469
Post summary
The text discloses a stored XSS vulnerability in RLE NOVA PlanManager affecting comment parameters; no PoC, exploit code, active exploitation, or patch information is provided.
0000077
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	nova-a	planmanager	-	-	-

Explore more

Back to dashboard nova-a CVEs planmanager vulnerabilities

What researchers are saying

CVE-2026-1469

CVE@CVEnewDisclosure

The text announces CVE-2026-1469, describing it as a stored XSS vulnerability in RLE NOVA's PlanManager, with no evidence of PoC, exploit code, or active exploitation.

INCIBE-CERT@incibe_certDisclosure

The tweet announces a stored XSS flaw (CVE‑2026‑1469) discovered in PlanManager of RLENOVA, referencing an INCIBE advisory link for details.

DailyCVE@dailycveDisclosure

A new stored XSS vulnerability (CVE‑2026‑1469) has been identified in RLE NOVA PlanManager, rated Medium severity. No exploit tools, patches, or active exploitation reports are provided.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text discloses a stored XSS vulnerability in RLE NOVA PlanManager affecting comment parameters; no PoC, exploit code, active exploitation, or patch information is provided.