Vulnerabilities

TI-2026-01252 CVE-2026-1563 · GHSA-pcfw-jm9h-vg4m

Cross-site scripting in Pegasystems Pega Infinity

LOW 22

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting (XSS) vulnerability in a user interface component.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00242 Published 2026-07-15 Fixed in Infinity 25.1.2 CWE-79

TI-2026-01251 CVE-2026-1562 · GHSA-9j28-r64w-w53x

Cross-site scripting in Pegasystems Pega Infinity

LOW 21

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component.

CVSS 4.0MEDIUM 4.6 Network High privileges User interaction EPSS 0.00242 Published 2026-07-15 Fixed in Infinity 25.1.2 CWE-79

TI-2026-01394 CVE-2026-1711 · GHSA-332r-xc5m-v45j

Cross-site scripting in Pegasystems Pega Infinity

LOW 21

Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-Site Scripting vulnerability in a user interface component.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00187 Published 2026-04-15 Fixed in Infinity 25.1.2 CWE-79

TI-2026-01253 CVE-2026-1564 · GHSA-hm98-22vr-c62v

Cross-site scripting in Pegasystems Pega Infinity

LOW 22

Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00187 Published 2026-04-15 Fixed in Infinity 25.1.2 CWE-80

TI-2025-38502 CVE-2025-62184 · GHSA-ch8g-69g3-3cc2

Cross-site scripting in Pegasystems Pega Infinity

LOW 22

Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00268 Published 2026-03-31 Fixed in Infinity 25.1.0 CWE-79

TI-2025-08754 CVE-2025-9559 · GHSA-2v78-25vx-vfrh

Authorization bypass in Pegasystems Pega Infinity

LOW 29

Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read data.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00409 Published 2025-10-16 Fixed in Infinity 24.2.3 CWE-639

TI-2025-07945 CVE-2025-8681 · GHSA-2mrv-xv63-4p6g

Cross-site scripting in Pegasystems Pega Infinity

LOW 24

Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00195 Published 2025-09-10 Fixed in Infinity 24.2.3 CWE-79

TI-2025-01893 CVE-2025-2161 · GHSA-j3pp-f94x-f42g

Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup

LOW 31

Pega Platform versions 7.2.1 to Infinity 24.2.1 are affected by an XSS issue with Mashup

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00287 Published 2025-04-14 Fixed in 24.2.2 CWE-79

TI-2025-01892 CVE-2025-2160 · GHSA-2h9w-x423-49m5

Pega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with Mashup

LOW 35

Pega Platform versions 8.4.3 to Infinity 24.2.1 are affected by an XSS issue with Mashup

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00287 Published 2025-04-14 Fixed in 24.2.2 CWE-79

TI-2024-11325 CVE-2024-12211

Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile.

LOW 24

Pega Platform versions 8.1 to Infinity 24.2.0 are affected by an Stored XSS issue with profile.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00326 Published 2025-01-13 Fixed in 24.2.1 CWE-79

TI-2023-27410 CVE-2023-50168 · GHSA-2x9x-24qc-mmqv

Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation.

LOW 34

Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00392 Published 2024-03-14 Fixed in 8.8.5 CWE-611

TI-2023-27409 CVE-2023-50167 · GHSA-rhvr-vw4q-5vc6

Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html content.

LOW 27

Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html content.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00298 Published 2024-03-06 Fixed in 23.1.2 CWE-79

TI-2023-04459 CVE-2023-4843 · GHSA-jmp8-vc2x-6f9g

Injection in Pegasystems Pega Platform

LOW 22

Pega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Business Director, however this field can only be modified by an authenticated administrative user.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00341 Published 2023-09-08 Fixed in 8.8.4 CWE-74

TI-2023-15393 CVE-2023-32090 · GHSA-9356-5wvv-mwc4

Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials

MEDIUM 50

Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00621 Published 2023-08-07 No fix listed CWE-1393

TI-2023-12673 CVE-2023-28094 · GHSA-phj7-p5r6-wj9c

Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a…

MEDIUM 43

Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default credentials.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0053 Published 2023-06-22 No fix listed CWE-1393

TI-2023-11612 CVE-2023-26465 · GHSA-crcx-jrrv-jphf

Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.

LOW 30

Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00443 Published 2023-06-09 Fixed in 8.8.2 CWE-79

TI-2022-16122 CVE-2022-35656 · GHSA-gp84-wpgp-jv9x

Cross-site request forgery in Pegasystems Pega Infinity

LOW 21

Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly.

CVSS 3.1MEDIUM 4.5 Network High privileges User interaction EPSS 0.00342 Published 2022-08-22 Fixed in 8.7.3 CWE-352

TI-2022-16121 CVE-2022-35655 · GHSA-wvf4-j5w7-r38j

Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting.

LOW 28

Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.005 Published 2022-08-22 Fixed in 8.7.3 CWE-79

TI-2022-16120 CVE-2022-35654 · GHSA-4r6c-7c28-gmfr

Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.

LOW 28

Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00544 Published 2022-08-22 Fixed in 8.7.3 CWE-79

TI-2020-12137 CVE-2020-15390 · GHSA-8wgv-7v96-3px7

pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an…

MEDIUM 45

pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an improper access control vulnerability via =GetWebInfo.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01396 Published 2021-04-12 No fix listed CWE-269

TI-2020-14741 CVE-2020-23957 · GHSA-q835-q3qm-4v3c

Pega Platform through 8.4.x is affected by Cross Site Scripting (XSS) via the…

LOW 28

Pega Platform through 8.4.x is affected by Cross Site Scripting (XSS) via the ConnectionID parameter, as demonstrated by a pyActivity=Data-TRACERSettings.pzStartTracerSession request to a PRAuth URI.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00686 Published 2020-12-15 No fix listed CWE-79

TI-2020-14900 CVE-2020-24353 · GHSA-2wgh-rqx2-f94c

Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header.

LOW 28

Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00648 Published 2020-11-09 No fix listed CWE-79

TI-2020-07035 CVE-2020-8774 · GHSA-f9xj-6ppw-6625

Pega Platform before version 8.2.6 is affected by a Reflected Cross-Site Scripting…

MEDIUM 40

Pega Platform before version 8.2.6 is affected by a Reflected Cross-Site Scripting vulnerability in the "ActionStringID" function.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0083 Published 2020-04-29 No fix listed CWE-79

TI-2019-12323 CVE-2019-16388 · GHSA-rpjx-w3gx-pgp2

PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct…

LOW 21

PEGA Platform 8.3.0 is vulnerable to Information disclosure via a direct prweb/sso/random_token/!STANDARD?pyStream=MyAlerts request to get Audit Log information while using a low-privilege account.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00715 Published 2019-11-26 No fix listed CWE-425

TI-2019-12322 CVE-2019-16387 · GHSA-cp7m-qccx-qc2g

PEGA Platform 8.3.0 is vulnerable to a direct…

LOW 37

PEGA Platform 8.3.0 is vulnerable to a direct prweb/sso/random_token/!STANDARD?pyActivity=Data-Admin-DB-Name.DBSchema_ListDatabases request while using a low-privilege account.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01045 Published 2019-11-26 No fix listed CWE-668

Vulnerabilities

Filters