SSCMS CVE-2026-7429

Q: What is the CVSS score of CVE-2026-7429?

CVE-2026-7429 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26417 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-30 VulnCheck

XSS Sscms

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 30, 2026 - 20:22 NVD

MEDIUM LOW

CVSS changed

Apr 30, 2026 - 20:22 NVD

4.6 (MEDIUM) 2.1 (LOW)

Analysis Generated

Apr 30, 2026 - 20:15 vuln.today

EUVD ID Assigned

Apr 30, 2026 - 20:00 euvd

EUVD-2026-26417

Analysis Generated

Apr 30, 2026 - 20:00 vuln.today

CVE Published

Apr 30, 2026 - 19:45 nvd

LOW 2.1

DescriptionCVE.org

SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attackers to execute arbitrary JavaScript by crafting malicious STL template payloads that are decrypted and returned without proper sanitization. Attackers can exploit improper output encoding in the /api/stl/actions/dynamic endpoint to inject executable JavaScript into JSON responses, leading to session hijacking, phishing attacks, and unauthorized actions performed on behalf of users.

AnalysisAI

Reflected cross-site scripting in SSCMS v7.4.0 allows authenticated attackers to inject arbitrary JavaScript through crafted STL template payloads in the /api/stl/actions/dynamic endpoint. The vulnerability arises from improper output encoding when decrypted STL templates are returned in JSON responses, enabling session hijacking, credential theft via phishing, and unauthorized user actions. User interaction is required to trigger the payload, limiting but not eliminating real-world risk.

Technical ContextAI

SSCMS (SiteServer CMS) is a content management system that uses STL (SiteServer Template Language) for dynamic content rendering. The vulnerability exists in the STL processing endpoint, specifically in /api/stl/actions/dynamic, which accepts STL template payloads, decrypts them server-side, and returns the output as JSON. The root cause is CWE-79 (Cross-site Scripting), specifically improper output encoding - the application fails to sanitize or encode JavaScript-executable content before inserting decrypted templates into JSON response bodies. This allows an attacker-controlled STL template to break out of intended data contexts and execute as JavaScript in the victim's browser. The CPE cpe:2.3:a:siteserver:sscms:*:*:*:*:*:*:*:* indicates the vulnerability affects the SiteServer SSCMS product line.

RemediationAI

Apply output encoding (HTML entity encoding or JSON-safe escaping) to all decrypted STL template content before returning it in JSON responses from the /api/stl/actions/dynamic endpoint. The SiteServer CMS project should implement a patched version that properly encodes special characters (quotes, angle brackets, etc.) in JSON responses. Until a patch is available, implement a Content Security Policy (CSP) header with script-src 'self' to mitigate inline script injection, though this does not address the root cause. Additionally, enforce strict input validation on STL template payloads - validate that decrypted content conforms to expected template syntax and reject payloads containing JavaScript keywords or event handlers. Monitor the GitHub repository at https://github.com/siteserver/cms and VulnCheck advisory at https://www.vulncheck.com/advisories/sscms-reflected-cross-site-scripting-via-stl-processing for patch availability and updates.