What is the CVSS score of CVE-2026-30919?

CVE-2026-30919 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Facilemanager are affected by CVE-2026-30919?

facileManager versions up to 6.0.4 contain a cross-site scripting (XSS) vulnerability that could allow attackers to compromise administrator accounts and gain unauthorized access to critical…

How to fix or mitigate CVE-2026-30919?

Within 24 hours: Identify all instances of facileManager in production and document version numbers; implement network access controls to restrict facileManager to trusted administrative networks only. Within 7 days: Deploy WAF rules to block malicious script payloads targeting known XSS injection points; conduct audit of user sessions for suspicious activity. Within 30 days: Monitor vendor advisories for patch availability; evaluate alternative sysadmin tools if patch timeline becomes unacceptable; implement mandatory security awareness training on XSS attack vectors for administrative staff.

Facilemanager CVE-2026-30919

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-10 security-advisories@github.com

XSS Facilemanager

7.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 17:40 nvd

HIGH 7.6

DescriptionGitHub Advisory

facileManager is a modular suite of web apps built with the sysadmin in mind. Prior to 6.0.4 , stored XSS (also known as persistent or second-order XSS) occurs when an application receives data from an untrusted source and includes that data in its subsequent HTTP responses in an unsafe manner. This vulnerability was found in the fmDNS module. This vulnerability is fixed in 6.0.4.

AnalysisAI

facileManager is a modular suite of web apps built with the sysadmin in mind. versions up to 6.0.4 is affected by cross-site scripting (xss) (CVSS 7.6).

Technical ContextAI

This vulnerability (CWE-79: Cross-site Scripting (XSS)) exists in the fmDNS component. facileManager is a modular suite of web apps built with the sysadmin in mind. Prior to 6.0.4 , stored XSS (also known as persistent or second-order XSS) occurs when an application receives data from an untrusted source and includes that data in its subsequent HTTP responses in an unsafe manner. This vulnerability was found in the fmDNS module. This vulnerability is fixed in 6.0.4.

RemediationAI

Fixed in version 6.0.4.. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.