---
id: "CVE-2026-107526"
page: "https://infrastack.ai/live/CVE-2026-107526"
kind: "vulnerability"
aliases: ["CVE-2026-107526"]
title: "Dell PowerStore: improper input validation enables stored cross-site scripting"
severity: "medium"
cvss: 4.6
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["dell-powerstore", "self-hosted", "storage", "vendor"]
not_affected_if: ["auth-required", "no-powerstore-deployed"]
published_at: "2026-11-13T13:17:40+00:00"
first_seen_at: "2026-11-13T13:46:51+00:00"
updated_at: "2026-11-13T13:48:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107526", "first_seen_at": "2026-11-13T13:46:51+00:00"}]
exploit_sources: []
---

# Dell PowerStore: improper input validation enables stored cross-site scripting

Link for people: https://infrastack.ai/live/CVE-2026-107526 (this .md is for agents)

Dell PowerStore storage appliances fail to validate input in the management interface, so a low-privileged logged-in user can store malicious script there. Other users who view the stored content can then have script run in their browser, which may let an attacker act as them in the management interface.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-13T13:46:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107526

## From the sources

Dell PowerStore contains an improper input validation vulnerability. An authenticated low-privileged attacker could exploit this vulnerability, potentially leading to stored cross-site scripting in the management interface.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_