EUVD-2026-53322
GHSA-pf9g-3vw7-vgqf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Public contact form is network-accessible with no auth; reflected XSS mandates victim interaction; scope change captures cross-origin script execution enabling session theft.
Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).
CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Lifecycle Timeline
1DescriptionCVE.org
299Ko's public contact form (plugin/contact/controllers/ContactController.php, home()) sets raw POST field values (name, firstname, email, message) into the page template with no sanitization. The template engine's variable output function (common/Template.php, _show_var()) echoes values with no htmlspecialchars() call, and the sink template (contact.tpl) outputs these values unescaped into an HTML attribute and a textarea. An unauthenticated attacker can submit a payload such as name="><script>alert(document.domain)</script> to achieve reflected XSS against any visitor who submits or is tricked into auto-submitting the form, including a targeted administrator, enabling session token theft.
AnalysisAI
Reflected XSS in 299Ko CMS's public contact form allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by submitting unsanitized POST field values that are echoed unescaped into HTML attributes and a textarea. The vulnerability is in the template engine's output function (_show_var() in common/Template.php), which lacks any htmlspecialchars() encoding, and is exploitable against any visitor - including a targeted administrator - enabling session token theft. No CISA KEV listing exists at time of analysis, but the CVE description provides exact code paths and a working payload, making independent exploit development trivial.
Technical ContextAI
The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the reflected variant. 299Ko is a PHP-based CMS. The root cause is a complete absence of output encoding across the data flow: ContactController.php's home() method assigns raw HTTP POST values (name, firstname, email, message) directly to template variables; the template engine's _show_var() in common/Template.php echoes these values without calling htmlspecialchars() or any equivalent sanitization; and the sink template contact.tpl renders the values in two dangerous HTML contexts - an attribute context (where injecting "> closes the attribute and tag to inject markup) and a textarea context (where </textarea> breaks out of the element). No CPE strings were provided, so exact version pinning is not possible from available data. The CVSS scope change (S:C) reflects that injected script executes in the 299Ko application's origin, crossing the application boundary into the victim browser's security context.
RemediationAI
No vendor-released patch has been identified at time of analysis. The definitive fix is to apply htmlspecialchars($value, ENT_QUOTES, 'UTF-8') within the _show_var() method of common/Template.php, which would enforce output encoding globally across all template variable rendering - this is the highest-leverage single change. Alternatively, sanitization can be applied in ContactController.php's home() method before assignment to template variables, though defense-in-depth favors fixing the template engine layer. Administrators unable to patch immediately should consider disabling the contact form endpoint if it is not operationally required, accepting the trade-off of losing the contact functionality entirely. A WAF rule blocking <script, event handler keywords (onerror, onload, onfocus), and quote-injection sequences ("> or '>) in POST body fields can reduce exposure, but obfuscated or encoded payloads may bypass naive pattern matching. Monitor 299Ko source repositories at https://github.com/search?q=299ko&type=repositories for upstream commits addressing this issue.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today