Vulnerability details

CVE-2026-104656

Progress Software Progress® Telerik® Fiddler® Everywhere

Cross-site Scripting in Progress Telerik Fiddler Everywhere

CVSS 3.1

7.3High

Official description

Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier allows an attacker to execute backend IPC commands by convincing a user to open a specially crafted SAZ file.

CVSS scores

Score	Version	Source	Vector
7.3High	3.1	CVEProject cvelistV5 (CNA) (ProgressSoftware)	`CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L`

Affected products

Vendor	Product	Versions	Source
Progress Software	Progress® Telerik® Fiddler® Everywhere	v < 8.3.0	CVEProject cvelistV5 (CNA)

References and advisories

https://www.telerik.com/fiddler/fiddler-everywhere/documentation/knowledge-base/kb-security-cross-site-scripting-cve-2026-104656 vendor-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-11-06
Last updated: 2026-11-06
State: Published
Assigner (CNA): ProgressSoftware

Exploit prediction (EPSS)

0.16%

Probability of exploitation in 30 days

6.1%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')