What is the CVSS score of CVE-2026-49259?

CVE-2026-49259 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N.

Is there a public PoC exploit available for CVE-2026-49259?

Yes, a public proof-of-concept exploit is available for CVE-2026-49259. Prioritise patching immediately.

How to fix or mitigate CVE-2026-49259?

Within 24 hours, inventory all NukeViet CMS 4.5.08 and earlier instances and restrict user profile and comment display to authenticated users only; enable comprehensive logging for all profile modifications and comment submissions. Within 7 days, deploy Web Application Firewall rules to detect and block HTML-encoded JavaScript patterns in profile fields (first_name, last_name), and conduct a full audit of existing user profiles for injected malicious code; implement network segmentation to limit administrative access to trusted IP ranges. Within 30 days, actively pursue patched version availability from NukeViet vendor and plan migration to either a patched build or an alternative CMS platform; establish incident response procedures for potential profile-based XSS exploitation.

NukeViet CMS CVE-2026-49259

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 https://github.com/nukeviet/nukeviet

GHSA-w2w5-w2pw-r929

PHP XSS Privilege Escalation

8.7

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Register low-privileged member account
Delivery

Store XSS payload in profile display name
Exploit

Post comment to embed handler
Execution

Admin clicks Reply link
Persist

onclick executes attacker JavaScript
Impact

Hijack admin session / exfiltrate data

Vulnerability Assessment

Weakness	CWE CWE-79 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Output encoding, context-aware escaping MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires a registered NukeViet member account (PR:L) in a default deployment where captcha_area_comm=1 (no CAPTCHA for logged-in users), auto_postcomm is enabled (comments publish immediately without moderation), and active_editinfo_censor=0 (profile edits apply without admin review) - all default values. The payload is placed in the first_name/last_name profile fields at /index.php?nv=users&op=editinfo and delivered via any comment. The critical limiting factor is required user interaction (UI:R): a victim - ideally an administrator - must click the Reply/"Answer" link on the attacker's comment for the onclick handler to fire; script execution also depends on the default CSP script-src allowing 'unsafe-inline'. If an operator sets captcha_area_comm=0, the same get_title(..., 1) processing of the anonymous comment name field enables exploitation without authentication.
Impact	The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, score 8.7 High) captures the profile accurately: network reachable, low attacker privilege (any registered member), and a required victim click on the Reply link (UI:R), with a scope change (S:C) because attacker-controlled script runs in a victim/administrator's browser context. No EPSS score, no CISA KEV entry, and no SSVC decision data were provided, so real-world exploitation frequency cannot be quantified from the input; the absence of KEV means it should not be treated as confirmed actively exploited. That said, a fully weaponized PoC (including a cookie-exfiltration variant verified end-to-end) is published in the vendor's GHSA advisory, and default configuration requires no CAPTCHA, no comment moderation, and no admin review of profile edits, which lowers the practical barrier considerably. The main limiting factor is UI:R - an administrator or visitor must actually click Reply on the attacker's comment - which makes this opportunistic/targeted rather than wormable. Net: a genuine high priority for NukeViet operators because of the low privilege requirement and public exploit, tempered by the required user interaction.
Exploit ScenarioDerived	An attacker registers an ordinary member account and sets their profile first_name to a value such as a');alert(document.domain);// which is stored HTML-entity-encoded, then posts any comment. When a site administrator later clicks the Reply/Answer link on that comment, the browser decodes the entities, breaks out of the JS string, and executes the attacker's script in the admin's authenticated session - the published PoC demonstrates both document.domain execution and a cookie/data-exfiltration variant verified against a local listener.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 13, 2026

Stored cross-site scripting in NukeViet CMS 4.x through 4.5.08 lets a low-privileged authenticated member embed a JavaScript payload in their profile display name (first_name/last_name), which then executes when any visitor - including administrators - clicks the Reply/Answer link on that member's comment. The flaw stems from HTML-entity encoding being applied where JavaScript-string escaping is required, so the payload runs in the victim's session context and can drive admin session actions, credential phishing, and data exfiltration. Publicly available exploit code exists (a working PoC is published in the GHSA advisory), though there is no public exploit identified as actively used in the wild.

RemediationAI

Upgrade NukeViet CMS to a fixed release - the advisory metadata lists the fix in 4.5.09 (patched range < 4.5.09) with the change carried forward to 4.6.00; treat 4.5.09 as the minimum patched version and confirm against the vendor advisory at https://github.com/nukeviet/nukeviet/security/advisories/GHSA-w2w5-w2pw-r929. The vendor-recommended code fix is to remove post_name from the inline onclick handler entirely and have nv_commment_feedback read the display name from the already-rendered DOM (the adjacent <strong class="cm_item"> element); if the value must be passed inline, encode it with PHP json_encode($post_name) to produce a proper JavaScript string literal rather than relying on HTML numeric character references. Where immediate patching is not possible, compensating controls include enforcing a stricter Content-Security-Policy that removes 'unsafe-inline' from script-src (side effect: existing inline onclick handlers across the theme will break and must be refactored to external handlers), enabling comment moderation by disabling auto_postcomm and enabling active_editinfo_censor so profile edits and comments are admin-reviewed before publication (side effect: added moderation workload and delayed publishing), and keeping captcha_area_comm at its default of 1 so anonymous comment posting cannot be abused for unauthenticated delivery. Teams should also audit other code paths that place get_title(..., true) output inside JavaScript string contexts.

Affected Packages

composer nukeviet/nukeviet fix: 4.6.00

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in composer

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

NukeViet is an open-source PHP/MySQL content management system (distributed as the composer package nukeviet/nukeviet). The vulnerability lives in the comment module template themes/default/modules/comment/comment.tpl (lines 27 and 64), where the {COMMENT.post_name} variable is interpolated into an inline onclick handler: onclick="nv_commment_feedback(event, {COMMENT.cid}, '{COMMENT.post_name}')". The display name is sanitized via Request::_get_title() with $specialchars=true, which converts characters such as the apostrophe to HTML numeric character references (' → '). This is a textbook CWE-79/CWE-116 output-encoding mismatch: browsers decode HTML entities in attribute values before the JavaScript engine parses the embedded string literal, so ' is decoded back to a real apostrophe that terminates the JS string early and the remainder executes as script. Contributing factors include a CSP script-src of 'unsafe-inline', which permits inline onclick handlers to run.

Know when PHP gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

vuln.today AI 8.7 HIGH

Any low-privileged member can store the payload (PR:L, AC:L, AV:N); a victim must click Reply (UI:R); script runs in the victim's browser crossing a trust boundary (S:C) enabling session/content compromise (C:H/I:H), with no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

DescriptionGitHub Advisory

Summary

A stored cross-site scripting (XSS) vulnerability exists in NukeViet CMS versions 4.x through 4.5.08. A low-privileged authenticated user can store a JavaScript payload in their profile's display name fields. The payload executes in the browser of any visitor - including administrators - who clicks the Reply ("Answer") link on a comment posted by that user.

Affected Component

The {COMMENT.post_name} template variable is interpolated without JavaScript-context escaping into an inline onclick handler in both comment block positions:

themes/default/modules/comment/comment.tpl line 27 (top-level comments)
themes/default/modules/comment/comment.tpl line 64 (nested/reply comments)

html

onclick="nv_commment_feedback(event, {COMMENT.cid}, '{COMMENT.post_name}')"

Root Cause

The first_name and last_name profile fields are sanitized with HTML numeric character references (' → ', ( → (, ) → ), / → /) via Request::_get_title() with $specialchars = true. This encoding is correct for plain HTML attribute and element contexts, but insufficient for a JavaScript string literal embedded inside an HTML attribute.

Browsers decode HTML entities in attribute values before the JavaScript engine parses the string. As a result, ' is decoded back to ', which terminates the JS string early and allows the remainder of the value to be executed as JavaScript.

The combined display name (nv_show_name_user(first_name, last_name)) is what reaches the template, giving an attacker up to ~200 encoded characters across both fields - sufficient for any practical payload.

Proof of Concept

Set first_name to the following value in profile settings (/index.php?nv=users&op=editinfo), then post any comment:

text

a');alert(document.domain);//

The value is stored as a');alert(document.domain);//.

When a visitor clicks the Reply link on the comment, the browser renders:

nv_commment_feedback(event, 1, 'a');alert(document.domain);// Tester')

causing alert(document.domain) to execute in the visitor's browser context.

A data-exfiltration variant (split across both name fields) navigates the victim's browser to an attacker-controlled URL carrying document.cookie as a query parameter. End-to-end verification was performed using a local listener.

Exploitation Conditions (default configuration)

Condition	Default value	Effect
`captcha_area_comm`	`1`	No CAPTCHA for logged-in users - payload delivery requires no CAPTCHA solve
`auto_postcomm`	enabled	Comments are published immediately without moderation
`active_editinfo_censor`	`0`	Profile edits take effect immediately without admin review
CSP `script-src`	`'unsafe-inline'`	Inline `onclick` handlers execute normally

Any registered member can set the payload and post a comment with no additional steps.

If captcha_area_comm is set to 0, the name field of anonymous comments (modules/comment/funcs/post.php) is processed by the same get_title(..., 1) call, making exploitation possible without authentication.

Impact

An attacker with a regular user account can execute arbitrary JavaScript in the browser of any visitor who interacts with the Reply button on their comment, including site administrators.

Practical consequences include:

Privilege escalation via admin session hijacking - forging administrative actions (content modification, account manipulation) in the context of an authenticated admin.
Credential phishing - injecting a fake login form into the page.
Data exfiltration - reading page content and non-HttpOnly cookies.

> Note: NukeViet session cookies carry the HttpOnly flag, so they are not directly readable via document.cookie; however, the above attack vectors remain fully viable.

Remediation

Preferred fix: Remove post_name from the inline handler entirely. Pass only cid to nv_commment_feedback and have the function retrieve the display name from the already-rendered DOM (e.g., the adjacent <strong class="cm_item"> element).

Alternative fix: If the value must be passed inline, encode it with json_encode($post_name) (PHP) so that the output is a properly escaped JavaScript string literal, not an HTML-entity-encoded one. HTML numeric character references must not be relied upon for JavaScript string escaping.

As a general note, the result of get_title(..., $specialchars=true) is safe for HTML element content and quoted HTML attribute values, but unsafe when placed inside a JavaScript string literal within an attribute. Other locations in the codebase using the same pattern should be audited.

Resources

OWASP: Cross Site Scripting Prevention - Rule 2: Attribute Encoding is Not Sufficient for JS Contexts
CWE-79: Improper Neutralization of Input During Web Page Generation
CWE-116: Improper Encoding or Escaping of Output

Executive ViewAI

Why It Matters

NukeViet CMS versions 4.5.08 and earlier contain a stored cross-site scripting vulnerability that allows low-privileged users to embed malicious JavaScript in profile display names, compromising administrator sessions and enabling credential theft or unauthorized data access when admins interact with affected user profiles.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement strict input validation and sanitization on first_name and last_name fields, blocking HTML-encoded JavaScript payloads at the application layer; (2) Deploy WAF rules targeting stored XSS patterns in user profile display zones; (3) Restrict user profile and comment visibility to authenticated sessions only; (4) Enable detailed audit logging on all profile edits and monitor for suspicious JavaScript injection patterns; (5) Enforce shorter administrative session timeouts and implement mandatory re-authentication for sensitive operations.

Threat Intelligence Overview

Prevalence

Low

Niche open-source CMS, popular in Vietnam but limited global enterprise footprint

Threat Intel

1 source

Exploit

POC

Public exploit code exists

Social Media

Sightings

Data Quality

3 sources

Confidence: Low

NVD

CVE.org GHSA CIRCL

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS N/A

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Cross-Site Scripting MEDIUM

Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.