Live › vulnerability › CVE-2026-113695
BMC IT Service Management Suite's SmartIT inline-image attachment feature reflects user input into HTML responses without proper escaping. An authenticated user can inject script that runs in the browser of another user who views the response.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 14:25 UTC. All times on this page are UTC.
Organisations running BMC IT Service Management Suite versions 25.3.01, 25.4.01 or 26.1.01 with the SmartIT inline-image attachment feature. Exploitation needs a logged-in user, and the script runs in the browser of a different user who views the crafted content. Deployments on other versions, or without SmartIT, are not listed as affected.
No product ranges from the sources yet.
25.3.01, 25.4.01 or 26.1.01 are listed as affected25.3.01, 25.4.01, : no fixed version stated in the sources; check the vendor advisory26.1.01Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.
This page as .md · .json · in your agent: get_signal("CVE-2026-113695")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.