CVE-2026-1695 | THREATINT

Description

An XSS vulnerability affects the OAuth web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to trick a legitimate user into loading content from another site upon unsuccessful user authentication on an unknown application (unknown client_id). This vulnerability only affects the error page of the OAuth server.

PUBLISHED Reserved 2026-01-30 | Published 2026-02-26 | Updated 2026-02-26 | Assigner arcinfo

MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:N/AU:Y/R:U/RE:M/U:Clear

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status

unaffected

16.0.0 (cpe)

affected

15.0.0 (cpe)

affected

12.0.0 (cpe)

affected

References

www.pcvue.com/security/ vendor-advisory

cve.org (CVE-2026-1695)

nvd.nist.gov (CVE-2026-1695)

Download JSON