CVE-2026-71881

UNKNOWN 0.0

Cross-site scripting in Integrated Publishing Toolkit

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Multiple injection issues in resource metadata fields in GBIF Integrated Publishing Toolkit versions before 3.3.5 allows authenticated remote attackers to execute code in another user's session after user interaction via stored cross-site scripting

CWE	CWE-79
Vendor	gbif
Product	integrated publishing toolkit
Published	Nov 6, 2026

Stay Ahead of the Next One

Get instant alerts for gbif integrated publishing toolkit

Be the first to know when new unknown vulnerabilities affecting gbif integrated publishing toolkit are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

GBIF / Integrated Publishing Toolkit

0 < 3.3.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/gbif/ipt/issues/3166 github.com: https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2026/MNDT-2026-0017.md