Is there a public PoC exploit available for CVE-2026-12202?

Yes, a public proof-of-concept exploit is available for CVE-2026-12202. Prioritise patching immediately. EPSS: 0.2%.

Subrion CMS CVE-2026-12202

Q: What is the CVSS score of CVE-2026-12202?

CVE-2026-12202 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-36677 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-06-15 VulDB

GHSA-wrcg-234w-hfhq

XSS Subrion Cms Intelliants

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

High-privilege auth and victim interaction required; scope changes because injected script executes in victim's browser context, yielding limited confidentiality and integrity impact.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Jun 15, 2026 - 02:22 NVD

MEDIUM LOW

CVSS changed

Jun 15, 2026 - 02:22 NVD

4.8 (MEDIUM) 1.9 (LOW)

Analysis Generated

Jun 15, 2026 - 02:14 vuln.today

DescriptionCVE.org

A vulnerability has been found in Intelliants Subrion CMS up to 4.0.3. Affected by this issue is some unknown functionality of the component Blocks Endpoint. Such manipulation of the argument CSS class name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Cross-site scripting in Intelliants Subrion CMS up to version 4.0.3 allows an authenticated high-privilege attacker to inject malicious JavaScript via the CSS class name argument in the Blocks Endpoint, executing in a victim user's browser upon viewing the manipulated block. Publicly available exploit code exists (disclosed on HackMD), and the vendor did not respond to responsible disclosure, leaving no patch available at time of analysis. Exploitation is constrained by a high-privilege authentication requirement and mandatory user interaction, limiting opportunistic mass exploitation but posing meaningful insider-threat and compromised-credential risk.

Technical ContextAI

Subrion CMS is a PHP-based content management platform by Intelliants, identified by CPE cpe:2.3:a:intelliants:subrion_cms:*:*:*:*:*:*:*:*. The Blocks Endpoint is an administrative interface that allows privileged users to define content blocks, including styling attributes such as CSS class names. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that the CSS class name argument is not properly sanitized or encoded before being rendered in HTML output - classic stored or reflected XSS depending on how block definitions are persisted and served. The CVSS 4.0 vector (E:P) confirms a proof-of-concept is publicly available, corroborated by the HackMD reference.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure, so no fixed version can be cited. As an immediate compensating control, administrators should restrict access to the Blocks Endpoint using application-level role controls or web server ACLs (e.g., nginx or Apache location directives limiting access by IP or internal network), preventing unauthorized or low-assurance accounts from reaching the vulnerable interface; this does not eliminate the flaw but narrows the attacker population. Deploying a strict Content Security Policy (CSP) header with a script-src 'self' directive can significantly reduce the impact of successful XSS injection by blocking execution of injected scripts, though it introduces trade-offs with any inline JavaScript legitimately used by the CMS. Review the public PoC at https://hackmd.io/@noka/B1sue5Xkzl to confirm whether your deployment is affected by the specific block configuration demonstrated. Monitor VulDB at https://vuldb.com/cve/CVE-2026-12202 for any future vendor patch release.