Description
Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Severity (CVSS)
| Base score | 5.4 |
|---|---|
| Severity | Medium |
| Version | CVSS 3.1 |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| Provided by | CISA-ADP |
Weaknesses
- CWE-79 — CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Jenkins Project | Jenkins Qualys Container Scanning Connector Plugin | 0 to <=1.8.0.5 |
References
- https://www.jenkins.io/security/advisory/2026-08-05/#SECURITY-3749 (vendor-advisory)
Generated from the official CVE List on 06 Aug 2026 07:06 UTC.