Ragic Enterprise Cloud Database CVE-2026-15552

Q: What is the CVSS score of CVE-2026-15552?

CVE-2026-15552 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43270 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 twcert

GHSA-gv5r-m2vf-6q47

XSS Enterprise Cloud Database Ragic

5.3

CVSS 4.0 · Vendor: twcert

Severity by source

Vendor (twcert) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network-reachable, no privileges required, stored payload triggers on victim page load (UI:R), scope changes to victim browser with session/content impact (C:L/I:L).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (twcert).

CVSS VectorVendor: twcert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 04:25 vuln.today

DescriptionCVE.org

Enterprise Cloud Database developed by Ragic has a Stored Cross-Site Scripting vulnerability, allowing unauthenticated remote attackers to inject persistent JavaScript code executed in users' browsers upon page load.

AnalysisAI

Stored XSS in Ragic Enterprise Cloud Database permits unauthenticated remote attackers to inject persistent JavaScript into application data, which then executes in the browsers of any user who loads the affected page. Because the payload is stored server-side, a single injection event affects all subsequent visitors without further attacker interaction. No active exploitation is confirmed in CISA KEV and no public proof-of-concept code has been identified at time of analysis, but the CVSS 4.0 PR:N rating confirms no authentication is needed to plant the payload.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-supplied input is persisted to the database and later reflected into HTML responses without adequate encoding or sanitization. The affected product, identified via CPE cpe:2.3:a:ragic:enterprise_cloud_database:*:*:*:*:*:*:*:*, is Ragic's cloud-hosted low-code database and form-building platform. Stored XSS is the more severe XSS subclass because the payload survives across sessions; every authenticated or unauthenticated user who views the poisoned record or page triggers execution. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms network reachability with no special attack conditions and passive user interaction (victim simply loads the page).

RemediationAI

The primary remediation is to apply any patch or configuration update issued by Ragic as referenced in the TWCERT advisories at https://www.twcert.org.tw/tw/cp-132-11031-eccb2-1.html and https://www.twcert.org.tw/en/cp-139-11032-460c2-2.html - no specific fixed version number was disclosed in the available intelligence, so consult the vendor directly to confirm the patched release. Because Ragic Enterprise Cloud Database is a SaaS-model platform, the vendor likely controls server-side remediation centrally; customers should verify with Ragic whether remediation has already been applied to their hosted instance. As a compensating control, organizations can configure a Content Security Policy (CSP) header to restrict script execution sources, which would neutralize injected inline JavaScript - trade-off is potential breakage of legitimate application scripts requiring CSP tuning. Additionally, restricting unauthenticated write access to form or record input fields, if the platform supports it, would remove the PR:N attack surface entirely. No patch version was independently confirmed from the available data.