CVE-2026-113695
MEDIUM—CVSS v3
—CVSS v2
—
EPSS (exploit probability)
CWE-79CWE
Description
Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.
Affected routers (0)
No routers currently mapped to this CVE in our database.