CVE-2026-32963 Cross-site scripting in AMC Manager

What is CVE-2026-32963?

CVE-2026-32963 is a medium-severity cross-site scripting vulnerability in silex technology, Inc. AMC Manager, published on 20 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

SD-330AC and AMC Manager provided by silex technology, Inc. contain a reflected cross-site scripting vulnerability. When a user logs in to the affected device and access some crafted web page, arbitrary script may be executed on the user's browser.

Weakness: CWE-79

Which versions are affected by CVE-2026-32963?

It affects 2 products.

Products include Silextechnology Amc Manager, Silextechnology Sd-330ac Firmware.

How do I fix CVE-2026-32963?

No fix has been published for CVE-2026-32963 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-32963 being exploited?

There is no known exploitation of CVE-2026-32963 in the wild and no public exploit code.

Other vulnerabilities in silex technology, Inc. AMC Manager

• CVE-2026-32956 Memory corruption in AMC Manager Critical 9.3
• CVE-2026-32955 Memory corruption in AMC Manager High 8.7
• CVE-2026-32965 Hardcoded credentials in AMC Manager High 8.7
• CVE-2026-32959 Weak cryptography in AMC Manager High 8.2
• CVE-2026-32960 Information disclosure in AMC Manager High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v94v-gwmf-jhq8.