EUVD-2026-92703Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Bacularis web UI
-
DeliveryInject script into Organization name
-
ExploitVictim admin loads organization view
-
ExecutionPayload executes in victim browser
-
ImpactSteal session or act as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to write a malicious payload into the Bacularis 'Organization name' field, which in practice requires an authenticated account with organization create/edit rights (contradicting the PR:N in the supplied vector). Execution is gated by victim user interaction (UI:R): a separate user, typically an administrator, must view a page that renders the stored organization name. Limiting factors: the attacker needs prior UI access, the payload only fires against users who load the affected view, impact is confined to the browser context (no direct server compromise), and only the specific Bacularis versions 5.4.0 through 6.5.1 are affected. |
| Impact | This is a moderate-severity stored/reflected Cross-Site Scripting flaw (CWE-79) in Bacularis, with the provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) yielding 6.1. The signals are mutually consistent in pointing to LOW real-world urgency: EPSS is 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit is confirmed - one reference path is literally named 'to_be_released', indicating exploit material is planned but not yet published. No SSVC decision record was supplied. The one internal tension is authentication: the vector declares PR:N (unauthenticated), yet injecting a payload into an 'Organization name' field realistically requires an authenticated account with privileges to create or edit organizations in the Bacularis UI - so PR:N likely overstates ease of access and should be verified against the vendor's permission model. Net: a genuine but low-priority web-app XSS affecting a niche backup-management console, not a mass-exploitation threat; patch during normal cycles rather than emergency response. |
| Exploit ScenarioDerived | An attacker who can create or edit an organization in the Bacularis web console stores a malicious script in the Organization name field; when an administrator or another user later views a page rendering that name, the script executes in their browser, enabling session token theft or actions performed as the victim. No public exploit code is currently identified, though a research write-up and a 'to_be_released' repository suggest a POC may follow. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Stored cross-site scripting in Bacularis 5.4.0 through 6.5.1 allows an attacker to write script content into the "Organization name" field, which is then rendered unsafely and executes in the browser of any user who views the affected page. The independent assessment rates this moderate at CVSS 6.1, and it requires an authenticated account holding organization create/edit rights plus victim interaction - a separate user, typically an administrator, must load the view that renders the stored name - with impact confined to the browser session and no direct server compromise. The supplied CVE record vector lists PR:N, but the assessed vector and exploitation conditions indicate PR:L is correct; exploitation status is no public exploit identified at time of analysis, upstream detection is minimal, and EPSS is low at 0.15% (4th percentile), though the 6.1 score together with a scope-changing (S:C) XSS in an administrative interface keeps this relevant for defenders who have not yet reviewed stored organization data.
RemediationAI
No vendor-released patch identified at time of analysis - the input contains no fix version, no vendor advisory with a patched release, and only researcher disclosure references (https://hekk.one/posts/research/cve-2026-95165/ and https://github.com/hekk-one/CVE), so the immediate priority is to confirm patch status with the Bacularis maintainers and monitor those disclosure pages. Because the independent assessment establishes that exploitation requires an authenticated account with organization create/edit rights, the highest-value compensating control with the lowest operational cost is to audit and minimize who holds those rights: restrict organization create/edit permissions to a small, trusted administrative group and remove them from general operators, accepting that this does not protect against a malicious insider who legitimately holds the role. Second, review and sanitize already-stored organization names in the Bacularis database, treating any value containing script or HTML markup as hostile and taking a database backup before modification, since the stored payload remains live for every user who loads the affected view. Third, where a reverse proxy or WAF sits in front of Bacularis, enable XSS-focused request inspection on the organization save endpoint to catch new injection attempts, with the trade-offs that rule tuning generates false positives on legitimate names and encoding-based bypasses are common. Fourth, deploy a Content-Security-Policy with a strict script-src on the administrative UI to blunt execution even if markup is stored, accepting that a strict policy can break inline scripts or third-party widgets and must be tested in a staging instance first. Until a fixed release is confirmed, upgrade planning should target the first Bacularis version published after 6.5.1 that explicitly references this CVE in its changelog, rather than assuming any specific version number that is not present in the source data.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e. cross-site scripting) in Bacularis, a web-based management application, specifically in the handling of the "Organization name" field. Rather than reflecting attacker input immediately, this is the stored/reflected pattern: the payload is persisted through the organization create/edit workflow and later emitted into a page that other users load, so the vulnerable sink is the output rendering path that fails to apply context-appropriate encoding or sanitization. The CVE record assigns CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, but the authoritative independent assessment corrects the privilege requirement to PR:L, since writing the payload in practice demands an authenticated session with organization create/edit rights; the UI:R component reflects that a distinct victim - commonly an administrator with access to the organization views - must interact by loading the affected page. The S:C scope change is the meaningful signal here: injected script escapes the vulnerable component's security context and runs with the trust of the administrative UI origin, which is what elevates a low-confidentiality/low-integrity script injection into a session-hijacking and privileged-action-forgery risk. Note that the threat-intelligence feed carries no usable CPE identification (all fields are reported as n/a) and EUVD lists affected versions as "n/a n/a", so exact product/version fingerprinting must be taken from the Bacularis release history (5.4.0 through 6.5.1 inclusive) rather than from automated CPE matching; the only substantive references are the researcher's own disclosure artifacts at github.com/hekk-one/CVE and hekk.one/posts/research/cve-2026-95165/, and the EUVD record EUVD-2026-92703 mirrors the same CVE-org data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Setting the Organization name requires an authenticated UI account, so PR:L rather than PR:N; stored XSS needs a victim to view the field (UI:R) and executes across a trust boundary into their browser (S:C).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB