CoinEx Crypto CVE-2026-105099

Exploitation requires (1) an authenticated low-privilege account on the CoinEx Crypto application (CVSS PR:L), and (2) the specific Ticket Attachment Upload functionality reachable at /user/ticket. The payload is stored, so it only triggers when a second user - typically a support agent or ticket viewer - opens the affected ticket in a browser (CVSS UI:P / passive interaction). These two factors (required authentication and required victim interaction) are the key limiters that reduce realistic risk below the network-reachable CVSS vector; there is no unauthenticated or zero-interaction path in the available data.

This is a medium-severity stored cross-site scripting flaw (CVSS 4.0 base 5.1) in the Ticket Attachment Upload feature of Omega Solution CoinEx Crypto 2025. The CVSS vector (AV:N/AC:L/PR:L/UI:P) indicates network-reachable, low-complexity exploitation that nonetheless requires an authenticated low-privilege account AND passive victim interaction, which materially caps impact - this is not a drive-by unauthenticated RCE. Impact is bounded to low integrity (VI:L) with no confidentiality or availability effect per the vendor-supplied vector, consistent with XSS that executes in a victim's browser rather than compromising the server. On real-world signals the picture is mixed: a public exploit exists (GitHub PoC + VulDB), which raises opportunistic risk, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. Crucially, the source data states the product website no longer exists and the product may be retired/replaced, and the vendor never responded to disclosure - meaning no patch is available and the installed base is likely tiny. Net: despite a public PoC, this is a low-real-priority issue for most organizations - a genuine but narrow, authenticated, interaction-dependent XSS in an apparently abandoned niche product, not a high-urgency threat.

An attacker who holds a low-privileged account uploads a malicious attachment to a support ticket via /user/ticket, embedding a script payload that is stored and later rendered. When a support agent or another user views the ticket, the script executes in their browser session, potentially performing actions in their authenticated context. A public proof-of-concept for this exact flaw is available on GitHub and VulDB, lowering the skill needed to reproduce it.