Description
HP App for Android is potentially vulnerable to cross-site scripting (XSS) when using an outdated version of the application via mobile devices. HP is releasing updates to mitigate these potential vulnerabilities.
Published: 2026-02-13
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross-Site Scripting
Action: Immediate Patch
AI Analysis

Impact

HP App for Android is vulnerable to cross-site scripting when an outdated version is used. The flaw allows an attacker to inject and execute malicious scripts within the app’s web views, potentially compromising user session data, injecting counterfeit content, or executing arbitrary actions on the device. This weakness is documented as CWE-79.

Affected Systems

The affected product is HP Inc’s HP App for Android. Any installation running an outdated version of the app is susceptible; no specific version numbers are supplied.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity, while the EPSS score of less than 1% and absence from the KEV catalog suggest a low probability of exploitation in the wild. The vulnerability likely requires the user to interact with malicious content or a compromised web page served within the app, making remote exploitation less straightforward.

Generated by OpenCVE AI on April 17, 2026 at 19:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest HP App update released by HP from the Google Play Store or official distribution channel.
  • If the latest update cannot be installed, uninstall or disable the outdated HP App to prevent exploitation.
  • Enforce device security policies that restrict execution of external scripts in web views, such as configuring managed device settings or using a mobile device management solution.

Generated by OpenCVE AI on April 17, 2026 at 19:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 13 Feb 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Hp Inc
Hp Inc hp App
Vendors & Products Hp Inc
Hp Inc hp App

Fri, 13 Feb 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 13 Feb 2026 15:15:00 +0000

Type Values Removed Values Added
Description HP App for Android is potentially vulnerable to cross-site scripting (XSS) when using an outdated version of the application via mobile devices. HP is releasing updates to mitigate these potential vulnerabilities.
Title HP App – Potential Cross-Site Scripting
Weaknesses CWE-79
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Hp Inc Hp App
cve-icon MITRE

Status: PUBLISHED

Assigner: hp

Published:

Updated: 2026-02-13T16:14:36.813Z

Reserved: 2026-01-28T21:52:11.057Z

Link: CVE-2026-1578

cve-icon Vulnrichment

Updated: 2026-02-13T16:12:02.078Z

cve-icon NVD

Status : Deferred

Published: 2026-02-13T15:15:57.853

Modified: 2026-04-15T00:35:42.020

Link: CVE-2026-1578

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T20:00:09Z

Weaknesses