CVE-2026-69662
Toptech TMS7 and TopHAT Eval Injection
CVE-2026-69662 is a low vulnerability (CVSS 2.1) in Shopify Tophat, published September 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. No source names a fixed version.
- Severity
- 2.1 LowCVSS 4.0, CVE List
- Exploit chance
- 0.19%EPSS, 8th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
The application uses unsafe functions that allow execution of inline scripts and string evaluation functions.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
What each source reports
CVE List Score used
Toptech TMS7 and TopHAT Eval Injection
The application uses unsafe functions that allow execution of inline scripts and string evaluation functions.
- Record
CVE-2026-69662- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-95
- Updated
- 2026-11-02
EUVDEUVD-2026-89475
The application uses unsafe functions that allow execution of inline scripts and string evaluation functions.
- Record
EUVD-2026-89475- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hxwh-85p6-wm8w
The application uses unsafe functions that allow execution of inline scripts and string...
The application uses unsafe functions that allow execution of inline scripts and string evaluation functions.
- Record
GHSA-hxwh-85p6-wm8w- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-95
- Updated
- 2026-11-02
NVD
The application uses unsafe functions that allow execution of inline scripts and string evaluation functions.
- Record
CVE-2026-69662- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-95
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.