CVE-2026-71189: Toptech TMS7 and TopHAT Cross-site Scripting

Low severity · published Sep 29, 2026

CVE-2026-71189

Toptech TMS7 and TopHAT Cross-site Scripting

3.5

CVSS

0.2%

EPSS

On KEV

Description

An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

Low

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 8% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

TMS7 · Toptech Systems

7.6.3 · source: vendor

TopHAT · Toptech Systems

7.6.3 · source: vendor

In the news

VulnerabilityCritical

Toptech TMS7 and TopHAT

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access critical data or execute arbitrary code. The following versions of Toptech TMS7 and TopHAT are affected: TMS7 7.6.3 (CVE-2026-71379, CVE-2026-70356, CVE-2026-72510, CVE-2026-63713, CVE-2026-68954, CVE-2026-68068, CVE-2026-72507, CVE-2026-71302, CVE-2026-69662, CVE-2026-71189) TopHAT 7.6.3 (CVE-2026-71379, CVE-2026-70356, CVE-2026-72510, CVE-2026-63713, CVE-2026-68954, CVE-2026-68068, CVE-2026-72507, CVE-2026-71302, CVE-2026-69662, CVE-2026-71189) CVSS Vendor Equipment Vulnerabilities v3 10 Toptech Systems Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties, Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Session Fixation, Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Background Critical Infrastructure Sectors: Energy, Chemical, Transportation Systems Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-71379 The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request. View CVE Details Affected Products To...

CVE-2026-71379 CVE-2026-70356 CVE-2026-72510

Sep 29, 2026·CISA Advisories

Affected product

TMS7

Toptech Systems

All TMS7 CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-71189

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-71189

www.toptech.com

https://www.toptech.com/blog/tms7-version-7-8-strengthens-security

www.cisa.gov

https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-02

github.com

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-272-02.json