Toptech TMS7 and TopHAT Cross-site Scripting
Priority LOW 21CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00186 8th percentileScored 2026-11-07
Fix Fixed TMS7 (Toptech Systems): 7.8TopHAT (Toptech Systems): 7.8
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Toptech Systems | TMS7 | 7.6.3 | 7.8 | Patch available | CNA |
| Toptech Systems | TopHAT | 7.6.3 | 7.8 | Patch available | CNA |
- TMS7 VendorToptech Systems Affected 7.6.3 Fixed in 7.8 Patch available CNA
- TopHAT VendorToptech Systems Affected 7.6.3 Fixed in 7.8 Patch available CNA
Remediation
- Fix · CNA TMS7 (Toptech Systems) Fixed in 7.8
- Fix · CNA TopHAT (Toptech Systems) Fixed in 7.8
Timeline
- 2026-10-02 Threatist record created from CVE-2026-71189
- 2026-10-03 Alias added: GHSA-c626-px4f-p5qx
References
More Toptech Systems vulnerabilities
- TI-2026-50020 Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties CVSS 4.0CRITICAL 10.0
- TI-2026-49169 Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type CVSS 4.0CRITICAL 9.4
- TI-2026-10774 Toptech Systems RCU II+ and Multiload II+ Missing Authentication for Critical Function CVSS 4.0HIGH 8.7
- TI-2026-50785 Toptech TMS7 and TopHAT SQL Injection CVSS 4.0HIGH 8.5
- TI-2026-50783 Toptech TMS7 and TopHAT SQL Injection CVSS 4.0HIGH 8.5
- TI-2026-48473 Toptech TMS7 and TopHAT SQL Injection CVSS 4.0HIGH 8.5
Sources
- CVE-2026-71189 · CVE Program
- CVE-2026-71189 · NVD
- FIRST EPSS
- GHSA-c626-px4f-p5qx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences