Stored cross-site scripting in İzometri eimzamip
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-80.
Summary
The eimzamip product from İzometri, from v1.6.4 before v1.6.7, does not neutralize script-related HTML tags in a web page. A remote attacker with low privileges can store script that runs in the browser of another user who views the affected page, and this requires that user to interact with the page. The weakness is classified as CWE-80.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Stored XSS. This issue affects eimzamip: from v1.6.4 before v1.6.7.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| İzometri IT Services Domestic and Foreign Trade Co. Ltd. | eimzamip | v1.6.4 to before v1.6.7 | v1.6.7 | Patch available | CNA |
- eimzamip Vendorİzometri IT Services Domestic and Foreign Trade Co. Ltd. Affected v1.6.4 to before v1.6.7 Fixed in v1.6.7 Patch available CNA
Remediation
The flaw is fixed in eimzamip v1.6.7. Update eimzamip to v1.6.7 or a later version.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA eimzamip (İzometri IT Services Domestic and Foreign Trade Co. Ltd.) Fixed in v1.6.7
Timeline
- 2026-10-08 Threatist record created from CVE-2026-89290
- 2026-10-08 Alias added: GHSA-95jq-mxqx-3p79
References
More İzometri IT Services Domestic and Foreign Trade Co. Ltd. vulnerabilities
- TI-2026-69467 Remote Code Execution via Unrestricted File Upload in İzometri Informatics' eimzamip CVSS 3.1HIGH 7.3
Sources
- CVE-2026-89290 · CVE Program
- CVE-2026-89290 · NVD
- FIRST EPSS
- GHSA-95jq-mxqx-3p79 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences