OnboardLite has stored Cross-site Scripting issue that may lead to admin Account Take Over
Priority LOW 34CWE-116Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
OnboardLite is a comprehensive membership lifecycle platform built for student organizations at the University of Central Florida. Versions of the software prior to commit 1d32081a66f21bcf41df1ecb672490b13f6e429f have a stored cross-site scripting vulnerability that can be rendered to an admin when they attempt to migrate a user's discord account in the dashboard. Commit 1d32081a66f21bcf41df1ecb672490b13f6e429f patches the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00275 20th percentileScored 2026-11-07
Fix Fixed OnboardLite (HackUCF): 1d32081a66f21bcf41df1ecb672490b13f6e429f
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HackUCF | OnboardLite | before 1d32081a66f21bcf41df1ecb672490b13f6e429f | 1d32081a66f21bcf41df1ecb672490b13f6e429f | Patch available | CNA |
- OnboardLite VendorHackUCF Affected before 1d32081a66f21bcf41df1ecb672490b13f6e429f Fixed in 1d32081a66f21bcf41df1ecb672490b13f6e429f Patch available CNA
Remediation
- Fix · CNA OnboardLite (HackUCF) Fixed in 1d32081a66f21bcf41df1ecb672490b13f6e429f
Timeline
- 2026-10-02 Threatist record created from CVE-2026-23880
References
More HackUCF vulnerabilities
- TI-2025-35171 OnboardLite Open Redirect Endpoint CVSS 4.0MEDIUM 5.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences