Is there a public PoC exploit available for CVE-2026-58475?

Yes, a public proof-of-concept exploit is available for CVE-2026-58475. Prioritise patching immediately. EPSS: 0.2%.

Sustainable Irrigation Platform CVE-2026-58475

Q: What is the CVSS score of CVE-2026-58475?

CVE-2026-58475 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43681 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-14 VulnCheck

GHSA-fjj7-xvgh-3jwr

XSS Sip

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network-exploitable stored XSS with no auth required (PR:N, AC:L); scope change as payload executes in victims' browsers (S:C); limited confidentiality and integrity loss via session theft; no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 14:48 vuln.today

CVE Published

Jul 14, 2026 - 14:19 cve.org

MEDIUM 5.3

DescriptionCVE.org

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by supplying malicious script payloads within program names submitted via HTTP requests. Attackers can exploit the lack of output encoding on rendered program names to execute arbitrary JavaScript in the browsers of any users viewing the affected page, with exploitation facilitated by the absence of a required passphrase or the default passphrase 'opendoor'.

AnalysisAI

Stored cross-site scripting in Sustainable Irrigation Platform (SIP) through version 5.2.16 enables unauthenticated remote attackers to permanently inject arbitrary JavaScript by submitting crafted program names via HTTP requests, with the payload executing in every subsequent viewer's browser. Exploitation is significantly facilitated by the application's acceptance of submissions with no passphrase configured or using the default passphrase 'opendoor', removing any authentication barrier in common deployments. A publicly available proof-of-concept exploit from ZeroScience (ZSL-2026-5994) documents the attack path; this CVE is not currently listed in the CISA KEV catalog.

Technical ContextAI

Sustainable Irrigation Platform (SIP), identified by CPE cpe:2.3:a:dan-in-ca:sip:*:*:*:*:*:*:*:*, is an open-source web-based irrigation management application developed by dan-in-ca. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the stored/persistent variant: user-supplied program names submitted via HTTP are persisted without sanitization and later rendered in the browser without output encoding, causing the application to treat attacker-controlled content as executable script. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:P confirms the flaw is exploitable over the network with no complexity or authentication prerequisites on the attacker side, with only passive victim interaction required to trigger payload execution. The wildcard CPE notation indicates NVD has not published a safe version boundary, covering all known releases through 5.2.16.

RemediationAI

No vendor-released patched version has been confirmed in the available intelligence data; defenders should monitor the ZeroScience advisory at https://www.zeroscience.mk/#/advisories/ZSL-2026-5994 and the VulnCheck advisory at https://www.vulncheck.com/advisories/sustainable-irrigation-platform-stored-xss-via-program-name for patch availability. As an immediate compensating control, operators must configure a strong non-default passphrase, replacing the default 'opendoor' value - this blocks unauthenticated program submission and eliminates the primary injection vector, though it does not fix the underlying encoding flaw and is ineffective if legitimate authenticated users are malicious. Network isolation of the SIP web interface to trusted management VLANs or via firewall rules preventing internet exposure reduces attacker reachability at the cost of remote administration capability. Content Security Policy (CSP) headers, if configurable at the web server layer in front of SIP, can limit the impact of any injected scripts by restricting script execution origins, though this is a partial mitigation only.