Vulnerability Details CVE-2026-34951
Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. Prior to 65.0.0, Workbench contains a reflected cross-site scripting vulnerability via the footerScripts parameter, which does not sanitize user-supplied input before rendering it in the page response. Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Workbench allows XSS Targeting Error Pages. This vulnerability is fixed in 65.0.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 12.9%
CVSS Severity
CVSS v3 Score 6.1
Products affected by CVE-2026-34951
-
cpe:2.3:a:salesforce:workbench:23.0.0
-
cpe:2.3:a:salesforce:workbench:24.0.0
-
cpe:2.3:a:salesforce:workbench:24.0.1
-
cpe:2.3:a:salesforce:workbench:25.0.0
-
cpe:2.3:a:salesforce:workbench:25.0.1
-
cpe:2.3:a:salesforce:workbench:25.0.2
-
cpe:2.3:a:salesforce:workbench:26.0.0
-
cpe:2.3:a:salesforce:workbench:26.0.1
-
cpe:2.3:a:salesforce:workbench:26.0.2
-
cpe:2.3:a:salesforce:workbench:27.0.0
-
cpe:2.3:a:salesforce:workbench:27.0.1
-
cpe:2.3:a:salesforce:workbench:27.0.2
-
cpe:2.3:a:salesforce:workbench:27.0.3
-
cpe:2.3:a:salesforce:workbench:27.0.4
-
cpe:2.3:a:salesforce:workbench:27.0.5
-
cpe:2.3:a:salesforce:workbench:27.0.6
-
cpe:2.3:a:salesforce:workbench:27.0.7
-
cpe:2.3:a:salesforce:workbench:27.0.8
-
cpe:2.3:a:salesforce:workbench:27.0.9
-
cpe:2.3:a:salesforce:workbench:28.0.0
-
cpe:2.3:a:salesforce:workbench:28.0.1
-
cpe:2.3:a:salesforce:workbench:28.0.2
-
cpe:2.3:a:salesforce:workbench:29.0.0
-
cpe:2.3:a:salesforce:workbench:29.0.1
-
cpe:2.3:a:salesforce:workbench:29.0.2
-
cpe:2.3:a:salesforce:workbench:29.0.3
-
cpe:2.3:a:salesforce:workbench:29.0.4
-
cpe:2.3:a:salesforce:workbench:29.0.5
-
cpe:2.3:a:salesforce:workbench:29.0.6
-
cpe:2.3:a:salesforce:workbench:29.0.7
-
cpe:2.3:a:salesforce:workbench:29.0.8
-
cpe:2.3:a:salesforce:workbench:29.0.9
-
cpe:2.3:a:salesforce:workbench:34.0.0
-
cpe:2.3:a:salesforce:workbench:34.0.1
-
cpe:2.3:a:salesforce:workbench:34.0.12
-
cpe:2.3:a:salesforce:workbench:34.0.13
-
cpe:2.3:a:salesforce:workbench:34.0.2
-
cpe:2.3:a:salesforce:workbench:34.0.3
-
cpe:2.3:a:salesforce:workbench:34.0.4
-
cpe:2.3:a:salesforce:workbench:34.0.5
-
cpe:2.3:a:salesforce:workbench:34.0.6
-
cpe:2.3:a:salesforce:workbench:34.0.7
-
cpe:2.3:a:salesforce:workbench:34.0.8
-
cpe:2.3:a:salesforce:workbench:34.0.9
-
cpe:2.3:a:salesforce:workbench:35.0.0
-
cpe:2.3:a:salesforce:workbench:36.0.0
-
cpe:2.3:a:salesforce:workbench:36.0.1
-
cpe:2.3:a:salesforce:workbench:36.0.2
-
cpe:2.3:a:salesforce:workbench:36.0.3
-
cpe:2.3:a:salesforce:workbench:36.0.4
-
cpe:2.3:a:salesforce:workbench:36.0.5
-
cpe:2.3:a:salesforce:workbench:36.0.6
-
cpe:2.3:a:salesforce:workbench:36.0.7
-
cpe:2.3:a:salesforce:workbench:37.0.0
-
cpe:2.3:a:salesforce:workbench:37.0.1
-
cpe:2.3:a:salesforce:workbench:37.0.2
-
cpe:2.3:a:salesforce:workbench:39.0.0
-
cpe:2.3:a:salesforce:workbench:40.0.0
-
cpe:2.3:a:salesforce:workbench:41.0.0
-
cpe:2.3:a:salesforce:workbench:41.0.1
-
cpe:2.3:a:salesforce:workbench:42.0.0
-
cpe:2.3:a:salesforce:workbench:43.0.0
-
cpe:2.3:a:salesforce:workbench:45.0.0
-
cpe:2.3:a:salesforce:workbench:45.0.1
-
cpe:2.3:a:salesforce:workbench:46.0.0
-
cpe:2.3:a:salesforce:workbench:47.0.0
-
cpe:2.3:a:salesforce:workbench:48.0.0
-
cpe:2.3:a:salesforce:workbench:49.0.0
-
cpe:2.3:a:salesforce:workbench:50.0.0
-
cpe:2.3:a:salesforce:workbench:51.0.0
-
cpe:2.3:a:salesforce:workbench:52.0.0
-
cpe:2.3:a:salesforce:workbench:53.0.0