EUVD-2026-41008
GHSA-rr2x-7r28-45fw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS requires victim to view the injected page (UI:R); PR:L reflects required low-privilege account; S:C and C:L/I:L capture cross-boundary session impact.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
1DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Stored XSS.
This issue affects DivvyDrive: from 4.8.2.23 before v.4.8.3.1.
AnalysisAI
Stored cross-site scripting in DivvyDrive (versions 4.8.2.23 through before 4.8.3.1) allows authenticated low-privilege attackers to inject persistent malicious scripts that execute in the browsers of other users who view affected pages. The CVSS scope change (S:C) reflects that injected scripts operate outside the application's security boundary, enabling session hijacking or credential theft against higher-privileged victims such as administrators. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and cross-scope impact make this a meaningful lateral escalation risk within DivvyDrive deployments.
Technical ContextAI
DivvyDrive is a web-based application developed by DivvyDrive Information Technologies Inc. (a Turkish vendor). The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored (persistent) variant, meaning user-supplied input is written to a data store and later rendered into HTML responses served to other users without proper output encoding or sanitization. The CVSS scope-change metric (S:C) is appropriate here because injected JavaScript executes in the victim's browser context, outside the vulnerable application's own trust boundary, enabling the script to access session tokens or perform authenticated actions on behalf of the victim. CPE: cpe:2.3:a:divvydrive_information_technologies_inc.:divvydrive:*:*:*:*:*:*:*:*.
RemediationAI
Upgrade DivvyDrive to version 4.8.3.1 or later, which resolves this stored XSS vulnerability per the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0475. If immediate patching is not feasible, restrict write access to DivvyDrive input fields to the minimum required set of trusted users, reducing the pool of accounts that could inject payloads. Deploying a strict Content Security Policy (CSP) header that disallows inline scripts can limit the exploitability of any stored payload, though this may break legitimate application functionality and requires testing. Additionally, audit stored content for existing script-like patterns and enable logging of content submission events from low-privilege accounts to detect exploitation attempts.
More in Divvydrive
View allOpen redirect vulnerability in DivvyDrive 4.8.2.9 through 4.8.3.1 allows remote unauthenticated attackers to redirect us
Stored cross-site scripting in DivvyDrive 4.8.2.9 through 4.8.3.1 enables remote attackers to inject malicious scripts t
Cross-site scripting (XSS) in DivvyDrive 4.8.2.9 through 4.8.3.1 allows remote unauthenticated attackers to execute arbi
Remote attackers can cause excessive resource allocation and flooding attacks in DivvyDrive 4.8.2.19 through 4.8.3.1 by
Cross-Site Request Forgery in DivvyDrive 4.8.2.9 through 4.8.3.1 allows remote attackers to execute unauthorized actions
Stored XSS in DivvyDrive versions v.4.8.2.23 through before v.4.8.3.1 enables an authenticated low-privilege user to inj
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today