Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ProjeQtor versions 7.0 through 12.4.3 contain a stored cross-site scripting vulnerability in the file upload functionality where the checkValidFileName() function fails to restrict HTML and HTM file uploads. Authenticated attackers can upload HTML files containing arbitrary JavaScript through the image upload or attachment endpoints, and any user accessing the uploaded file URL will execute the embedded JavaScript in their browser.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-41467 ProjeQtor versions 7.0 through 12.4.3 contain a stored cross-site scripting vulnerability in the file upload functionality where the checkValidFileName() function fai… https://www.cve.org/CVERecord?id=CVE-2026-41467
Post summary
The text discloses that ProjeQtor versions 7.0–12.4.3 are vulnerable to stored XSS via file upload because of an ineffective filename validation function.
CVE-2026-41467 Stored Cross-Site Scripting in ProjeQtor 7.0 Through 12.4.3 File Upload Functionality https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41467
Post summary
This entry reports a stored XSS vulnerability (CVE‑2026‑41467) affecting the file upload functionality in ProjeQtor versions 7.0 through 12.0.3.