CVE-2013-4946: Multiple cross-site scripting (XSS) vulnerabilities in BMC Service Desk Express (SDE) 10.2.1.95 allow remot...

Security readout for executives and security teams

This CVE describes multiple cross-site scripting flaws in BMC Service Desk Express 10.2.1.95. An attacker could inject script or HTML through specific web parameters, potentially affecting users who open crafted links or pages. The source bundle does not provide CVSS severity, active exploitation evidence, or a named vendor fix. Exposure is likely limited to organizations running BMC Service Desk Express 10.2.1.95, especially if the web interface is reachable by untrusted users or networks. Prioritize remediation if BMC SDE 10.2.1.95 is internet-facing or used by privileged support staff. Business urgency is moderate because XSS can support account compromise, but the bundle lacks severity scoring and active exploitation evidence. Mitigation focus: Identify any BMC Service Desk Express 10.2.1.95 deployments.; Check BMC support guidance for fixed versions or approved workarounds.; Restrict SDE web access to trusted networks or VPN where possible..

Prepared

Jun 14, 2026, 21:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.