EUVD-2026-77586
GHSA-wfvc-6jjf-4g5g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (ed10eef1-636d-4fbe-9993-6890dfa878f8) · only source for this CVE.
CVSS VectorVendor: ed10eef1-636d-4fbe-9993-6890dfa878f8
Lifecycle Timeline
2DescriptionCVE.org
Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed.
Successful exploitation may result in the execution of malicious scripts within the user's browser context when viewing API documentation. Users with permissions to access the API documentation through these portals may be impacted, potentially allowing attackers to perform actions on behalf of the user, depending on their session privileges.
AnalysisAI
Insufficient HTML sanitization in the WSO2 API Manager Publisher Portal and Developer Portal lets untrusted input be rendered without encoding, so malicious JavaScript injected into API documentation executes in the browser of anyone who opens the affected document. Attackers need an authenticated portal account with permission to author or edit API documentation, then can act on behalf of any user viewing that documentation depending on that user's session privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today