PHP
CVE-2026-54064
HIGH
GHSA-465g-4q99-5x86
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 13, 2026
Stored cross-site scripting in the NukeViet CMS News module (versions before 4.6.00) lets any authenticated user with news-posting permission persist arbitrary JavaScript that runs in the browser of every visitor, including administrators. Two independent filter bypasses defeat the built-in anti-XSS routines in NukeViet\Core\Request: a Form Feed (\x0C) prefix slips event-handler attributes past the /^on/ check, and a decimal HTML-entity tab (	) smuggles a javascript: URI past the keyword filter. Publicly available exploit payloads exist in the vendor advisory; there is no evidence of active exploitation and no EPSS figure was supplied.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
Summary
Two filter-bypass techniques in NukeViet\Core\Request::filterAttr() and NukeViet\Core\Request::unhtmlentities() allow a low-privileged user (any account with news post permission) to store and serve arbitrary JavaScript to any visitor of the affected page.
Affected Component
vendor/vinades/nukeviet/Core/Request.php - class NukeViet\Core\Request
Vulnerability Details
Bypass 1 - Form Feed character prefix (\x0C) before event handler name
The filterAttr() method blocks event-handler attributes using:
preg_match('/^on/i', $attrSubSet[0])PHP's trim() does not strip the ASCII Form Feed character (\x0C, U+000C). An attacker can prefix the attribute name with \x0C so that \x0Conerror does not match /^on/. The HTML5 browser parser treats \x0C as a valid whitespace separator and correctly activates the event handler.
Proof-of-concept payload (URL-encoded POST body field bodyhtml):
<img src="x" %0Conerror="alert('XSS')">Bypass 2 - Decimal HTML entity tab (	) inside javascript: URI
unhtmlentities() strips the hex-encoded tab 	 via str_ireplace, but did not strip its decimal equivalent 	. The keyword-blocking regex /j\s*a\s*v\s*a\s*s\s*c\s*r\s*i\s*p\s*t/si uses \s* which does not match HTML entities. The value jav	ascript:alert() passes the filter, is stored in the database, and is decoded by the browser into a working javascript: URI.
Proof-of-concept payload (inside a Markdown-style link):
[Click me](jav	ascript:alert('XSS'))Impact
An authenticated attacker with news-posting permission can inject persistent JavaScript that executes in the browser of any user (including administrators) who views the affected article. This enables session cookie theft, credential harvesting, defacement, and further privilege escalation.
Patches
Fixed in commit <commit-sha> by modifying vendor/vinades/nukeviet/Core/Request.php:
filterAttr()- strip all ASCII control characters (\x00-\x20) from the attribute name before the/^on/check:
$attrSubSet[0] = preg_replace('/[\x00-\x20]/', '', strtolower($attrSubSet[0]));unhtmlentities()- strip decimal HTML entities for all ASCII control characters (0-31) before the keyword checks:
$value = preg_replace('/�*(?:3[01]|[12][0-9]|[0-9]);/', '', $value);Workarounds
None. Update to the patched version.
Resources
- CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
- OWASP WSTG-INPV-02: Testing for Stored Cross Site Scripting
- OWASP Top 10 A03:2021 - Injection
Executive ViewAI
NukeViet CMS News module (versions before 4.6.00) contains a stored cross-site scripting vulnerability enabling authenticated users with news-posting permissions to inject malicious JavaScript executed in the browsers of all site visitors, including administrators. While no active exploitation has been confirmed, publicly available exploit code exists, immediately exposing any affected deployment. This creates significant risk to user account compromise, administrative session hijacking, and site integrity degradation.
Within 24 hours: audit all systems running NukeViet versions before 4.6.00, enumerate users with news-posting permissions, and immediately revoke posting access for all non-essential accounts. Within 7 days: perform forensic review of recent news post history for injected JavaScript; implement Content Security Policy headers to restrict inline script execution; enable enhanced logging on news module activity. Within 30 days: upgrade to NukeViet 4.6.00 or later once release notes confirm vulnerability remediation, or execute migration to an alternative CMS platform if upgrade timelines are infeasible.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict news-posting permissions to a minimal, pre-vetted administrative group; disable the news module entirely if not operationally critical; implement strict Content Security Policy headers to block inline script execution; conduct immediate code audit of all active news posts for malicious payloads; deploy enhanced logging and alerting on news module modifications and post creation/edits; configure Web Application Firewall rules to log suspicious payloads in news module POST requests, though signature-based detection has limited effectiveness against stored XSS variants using the documented filter bypasses.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Affected Products (CPE)GitHub Advisory
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB