DivvyDrive Stored XSS Vulnerability (CVE-2026-5784) Poses High Risk

The National Vulnerability Database has disclosed a high-severity Stored Cross-Site Scripting (XSS) vulnerability, CVE-2026-5784, affecting DivvyDrive Information Technologies Inc. DivvyDrive. This flaw, rated 8.8 CVSS (High), stems from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that execute in the context of other users.

Specifically, the vulnerability impacts DivvyDrive versions from 4.8.2.9 before 4.8.3.2. An unauthenticated attacker could exploit this by injecting malicious scripts into parameters that are stored and later rendered to other users. This allows for session hijacking, data theft, or defacement, all without direct user interaction beyond viewing a compromised page.

For defenders, this is a critical remote code execution vector. The attacker’s calculus here is straightforward: establish persistence, exfiltrate data, or pivot within the application. Given the ‘Network’ attack vector and ‘Low’ attack complexity, this is a high-reward target for opportunistic attackers. Patching is not optional; it’s an immediate imperative.