{"id":"EUVD-2026-18015","enisaUuid":"14005f0d-67d1-3c72-8e23-52737083a43a","description":"Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser. This issue has been patched in version 3.78.0.","datePublished":"Apr 1, 2026, 7:48:10 PM","dateUpdated":"Apr 2, 2026, 4:24:38 PM","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-mmxc-95ch-2j7c\n","aliases":"CVE-2026-34748\n","assigner":"GitHub_M","epss":0.29,"enisaIdProduct":[{"id":"c34cdac8-1bae-39ab-826c-55fdbd3e51b9","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.78.0"}],"enisaIdVendor":[{"id":"2a496aee-dc89-3cdb-b807-7c60a44661fe","vendor":{"name":"payloadcms"}}],"enisaIdVulnerability":[{"id":"3397a78f-716d-308e-8fe2-a4bc15711e39","vulnerability":{"id":"CVE-2026-34748","description":"Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser. This issue has been patched in version 3.78.0.","datePublished":"Apr 1, 2026, 7:48:10 PM","dateUpdated":"Apr 2, 2026, 4:24:38 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","references":"https://github.com/payloadcms/payload/security/advisories/GHSA-mmxc-95ch-2j7c\n","enisa_id":"EUVD-2026-18015\n","assigner":"GitHub_M","epss":0.29,"dataProcessed":"Nov 1, 2026, 7:19:41 AM","vulnerabilityProduct":[{"id":"8948d44d-66e5-35ac-adaa-c57dfc3cd779","product":{"name":"payload","vendor":{"name":"payloadcms"}},"product_version":"\u003c 3.78.0"}],"vulnerabilityVendor":[{"id":"c2c221e0-4d71-313f-92b2-a6c06875a2fe","vendor":{"name":"payloadcms"}}]}}],"enisaIdAdvisory":[]}