Skip to main content

SHIRASAGI CMS CVE-2026-81635

| EUVDEUVD-2026-75271 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-09-10 jpcert GHSA-gmpr-6m7m-7m27
XSS Shirasagi
5.1
CVSS 4.0 · Vendor: jpcert
Share

Severity by source

Vendor (jpcert) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.4 MEDIUM

Low-privileged attacker injects stored XSS; victim interaction required; scope changes to victim's browser with limited confidentiality and integrity impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

2
CVSS changed
Sep 10, 2026 - 07:22 NVD
5.4 (MEDIUM) 5.1 (MEDIUM)
Analysis Generated
Sep 10, 2026 - 07:02 vuln.today

DescriptionCVE.org

A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product.

AnalysisAI

Cross-site scripting in SHIRASAGI CMS allows an authenticated low-privileged attacker to inject arbitrary JavaScript that executes in the browser of other users visiting affected pages. The vulnerability carries a CVSS 5.4 (Medium) score with scope change (S:C), meaning attacker-controlled script runs outside the injector's own session - a common vector for session hijacking or admin account takeover in CMS platforms. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must hold a valid low-privileged (contributor-level) account on the target SHIRASAGI instance - unauthenticated exploitation is not possible per the PR:L CVSS metric. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 5.4 Medium rating is appropriate given PR:L (authenticated attacker) and UI:R (victim interaction required), which limits opportunistic mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the vendor-supplied patch referenced in the SHIRASAGI support advisory at https://www.ss-proj.org/support/1710.html - exact patched version should be confirmed directly from that page, as it is not included in the current dataset. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Shirasagi

View all
CVE-2022-43479 MEDIUM POC
6.1 Dec 05

Open redirect vulnerability in SHIRASAGI v1.14.4 to v1.15.0 allows a remote unauthenticated attacker to redirect users t
CVE-2023-22425 MEDIUM POC
5.4 Feb 24

Stored cross-site scripting vulnerability in Schedule function of SHIRASAGI v1.16.2 and earlier versions allows a remote
CVE-2022-43499 MEDIUM POC
5.4 Dec 05

Stored cross-site scripting vulnerability in SHIRASAGI versions prior to v1.16.2 allows a remote authenticated attacker

CVE-2023-41889 MEDIUM POC
5.3 Sep 15

SHIRASAGI is a Content Management System. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,

CVE-2023-39448 HIGH
8.8 Sep 05

Path traversal vulnerability in SHIRASAGI prior to v1.18.0 allows a remote authenticated attacker to alter or create arb
CVE-2023-22427 MEDIUM POC
4.8 Feb 24

Stored cross-site scripting vulnerability in Theme switching function of SHIRASAGI v1.16.2 and earlier versions allows a
CVE-2024-46898 HIGH
7.5 Oct 15

SHIRASAGI prior to v1.19.1 processes URLs in HTTP requests improperly, resulting in a path traversal vulnerability. Rate
CVE-2023-36492 MEDIUM
6.1 Sep 05

Reflected cross-site scripting vulnerability in SHIRASAGI prior to v1.18.0 allows a remote unauthenticated attacker to e
CVE-2022-29485 MEDIUM
6.1 Jun 14

Cross-site scripting vulnerability in SHIRASAGI v1.0.0 to v1.14.2, and v1.15.0 allows a remote attacker to inject an arb
CVE-2020-5607 MEDIUM
6.1 Jul 10

Open redirect vulnerability in SHIRASAGI v1.13.1 and earlier allows remote attackers to redirect users to arbitrary web

CVE-2019-6009 MEDIUM
6.1 Sep 12

Open redirect vulnerability in SHIRASAGI v1.7.0 and earlier allows remote attackers to redirect users to arbitrary web s
CVE-2023-38569 MEDIUM
5.4 Sep 05

Stored cross-site scripting vulnerability in SHIRASAGI prior to v1.18.0 allows a remote authenticated attacker to execut

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2026-81635 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy