A reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier

Exploitation

poc

Automatable

no

Technical impact

total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

1. Sep 4, 2026Published

   Disclosed via NVD

2. Sep 6, 2026EPSS first tracked

   0.2%

3. Sep 14, 2026Public exploit observed

   Exploit / PoC code exists

4. Sep 14, 2026CVSS changed

   — → 6.1

5. Sep 14, 2026Severity changed

   none → medium

6. Sep 14, 2026CVSS changed

   6.1 → —

7. Sep 14, 2026Severity changed

   medium → none

8. Sep 14, 2026CVSS changed

   — → 6.1

9. Sep 14, 2026Severity changed

   none → medium

10. Sep 17, 2026Record revised

    Last analysed / modified upstream

11. Sep 17, 2026CVSS changed

    6.1 → 5.4

12. Sep 17, 2026CVSS changed

    5.4 → 8.7

13. Sep 17, 2026Severity changed

    medium → high

14. Sep 19, 2026EPSS peak

    0.2% → 0.3%

Change history

Field changes observed since this record was first indexed.

• Sep 17, 2026CVSS 5.4 → 8.7
• Sep 17, 2026Severity medium → high
• Sep 17, 2026CVSS 6.1 → 5.4
• Sep 14, 2026Public exploit / PoC published
• Sep 14, 2026CVSS — → 6.1
• Sep 14, 2026Severity none → medium
• Sep 14, 2026Public exploit flag cleared
• Sep 14, 2026CVSS 6.1 → —
• Sep 14, 2026Severity medium → none
• Sep 14, 2026Public exploit / PoC published
• Sep 14, 2026CVSS — → 6.1
• Sep 14, 2026Severity none → medium