EUVD-2026-88139
GHSA-j58r-vr8w-6j93
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Remote unauthenticated reflected XSS needs no privileges but requires a victim click (UI:R); script executes in the weblog origin crossing the security boundary (S:C) with limited C/I impact and no availability effect.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
Articles & Coverage 4
AnalysisAI
Reflected cross-site scripting in Apache Roller 6.1.5 lets remote attackers inject script into the frontpage theme's directory page by supplying a crafted blog-directory parameter that is reflected without proper escaping; the script then executes in the browser of any visitor who follows the crafted link. Only weblogs using the bundled 'frontpage' theme are affected, and exploitation requires the victim to click a malicious link (UI:R) - no credentials are needed to craft or deliver it, but no public exploit code has been identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target weblog to be using the bundled 'frontpage' theme - weblogs on any other theme are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 6.1 (medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N accurately characterizes this as a reflected cross-site scripting flaw: network-reachable, low complexity, no privileges, but requiring user interaction (the victim must click a crafted link) and yielding only limited confidentiality/integrity impact within the weblog origin (S:C reflects script executing in the visitor's browser context). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Apache Roller 6.1.6 (or later) - upgrading is the recommended and definitive fix, since 6.1.6 validates and contextually escapes the reflected blog-directory parameter; the underlying change is visible in the upstream pull request https://github.com/apache/roller/pull/169 and rollout guidance is at https://roller.apache.org/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache Roller 6.1.5 deployments and identify any using the bundled 'frontpage' theme; for those instances, immediately disable or replace that theme where operationally feasible, deploy WAF or mod_security rules to block or sanitize crafted blog-directory parameters on the affected directory page, and enable enhanced logging to detect suspicious requests. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today