Is there a public PoC exploit available for CVE-2026-14704?

Yes, a public proof-of-concept exploit is available for CVE-2026-14704. Prioritise patching immediately. EPSS: 0.3%.

bluebox CVE-2026-14704

Q: What is the CVSS score of CVE-2026-14704?

CVE-2026-14704 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41725 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-07-05 VulDB

GHSA-vrf9-hq99-x9wm

XSS Bluebox

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network-delivered reflected XSS requiring victim click (UI:R), scope changes to victim browser (S:C), with low confidentiality and integrity impact; no auth needed.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 06:25 vuln.today

Severity Changed

Jul 05, 2026 - 06:22 NVD

MEDIUM LOW

CVSS changed

Jul 05, 2026 - 06:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was found in stephen-kruger bluebox up to 4.5.12. Affected by this vulnerability is an unknown functionality. Performing a manipulation of the argument code results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report.

AnalysisAI

Cross-site scripting in stephen-kruger bluebox up to version 4.5.12 allows remote attackers to inject and execute arbitrary JavaScript in victims' browsers by manipulating the 'code' argument in an unspecified function. The attack requires user interaction (CVSS 4.0 UI:P), meaning a victim must be induced to click a crafted link or visit a malicious page. A public exploit exists via a GitHub issue report, though no CISA KEV listing confirms active widespread exploitation. The CVSS 4.0 score of 2.1 reflects the constrained integrity-only impact and passive user-interaction requirement.

Technical ContextAI

bluebox is an application developed by stephen-kruger, hosted on GitHub (github.com/stephen-kruger/bluebox), affecting all versions up to and including 4.5.12 per the CPE string cpe:2.3:a:stephen-kruger:bluebox:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), meaning user-supplied input in the 'code' parameter is reflected into a web page response without adequate sanitization or encoding, allowing attacker-controlled script content to execute in the target user's browser session. The exact component or endpoint handling the 'code' argument is described as 'unknown functionality' in the NVD entry, limiting precise root-cause attribution without source-code review.

RemediationAI

No vendor-released patch identified at time of analysis. The vulnerability was disclosed via GitHub issue #32 (https://github.com/stephen-kruger/bluebox/issues/32), and the project maintainer was notified through responsible disclosure. Organizations running bluebox should monitor the repository for a patched release. As a compensating control, deploying a web application firewall (WAF) rule to block reflected XSS payloads in the 'code' parameter can reduce exposure; note that WAF bypass techniques exist and this should not be treated as a permanent fix. Additionally, restricting access to the affected functionality to trusted internal users only - if operationally feasible - limits the pool of potential victims, since the attack requires user interaction with a crafted link.