EUVD-2026-41010
GHSA-4qcc-v76c-xv54
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Stored XSS requires an authenticated low-privilege account (PR:L), victim page load (UI:R), and browser context escape confirms scope change (S:C); no availability impact applies.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
1DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Stored XSS.
This issue affects DivvyDrive: from v.4.8.2.23 before v.4.8.3.1.
AnalysisAI
Stored XSS in DivvyDrive versions v.4.8.2.23 through before v.4.8.3.1 enables an authenticated low-privilege user to inject persistent malicious scripts into application content that execute in the browsers of other users who subsequently view the affected page. The CVSS scope change indicator (S:C) reflects that the injected payload breaks out of the application's security boundary into the victim's browser context, enabling session hijacking or unauthorized actions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was disclosed by TR-CERT with a corresponding patch available.
Technical ContextAI
DivvyDrive is a web application product by DivvyDrive Information Technologies Inc., identified via CPE cpe:2.3:a:divvydrive_information_technologies_inc.:divvydrive:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically its stored variant, meaning user-controlled input is persisted server-side and later rendered unsanitized in HTML delivered to other users' browsers. Unlike reflected XSS, stored XSS does not require the attacker to trick a victim into clicking a crafted link - the payload is embedded in the application's own content. The CVSS scope change (S:C) confirms the injected script executes in a security context beyond the application origin, consistent with browser same-origin boundary violations typical of XSS attacks enabling cross-session impact.
RemediationAI
Upgrade DivvyDrive to version v.4.8.3.1 or later, which resolves this stored XSS vulnerability per the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0475. If immediate patching is not feasible, restrict write access to input fields or shared content areas within DivvyDrive to the minimum set of trusted users, reducing the attacker's opportunity to inject persistent payloads - note this is an access-control mitigation that does not eliminate the underlying vulnerability. Deploying a strict Content Security Policy (CSP) header with script-src restricted to trusted origins can reduce exploitability of any injected script, though misconfigured CSP policies can be bypassed and this remains a compensating control only. Monitor application logs for anomalous content submissions containing script tags or JavaScript event handlers as a detection measure.
More in Divvydrive
View allOpen redirect vulnerability in DivvyDrive 4.8.2.9 through 4.8.3.1 allows remote unauthenticated attackers to redirect us
Stored cross-site scripting in DivvyDrive 4.8.2.9 through 4.8.3.1 enables remote attackers to inject malicious scripts t
Cross-site scripting (XSS) in DivvyDrive 4.8.2.9 through 4.8.3.1 allows remote unauthenticated attackers to execute arbi
Remote attackers can cause excessive resource allocation and flooding attacks in DivvyDrive 4.8.2.19 through 4.8.3.1 by
Cross-Site Request Forgery in DivvyDrive 4.8.2.9 through 4.8.3.1 allows remote attackers to execute unauthorized actions
Stored cross-site scripting in DivvyDrive (versions 4.8.2.23 through before 4.8.3.1) allows authenticated low-privilege
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today