What is the CVSS score of EUVD-2026-27826?

EUVD-2026-27826 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Juzaweb CMS EUVD-2026-27826

| CVE-2026-36358 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-06 mitre

GHSA-5qfh-xfvx-w63g

XSS RCE N A

5.4

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 16:32 vuln.today

CVSS changed

May 06, 2026 - 15:22 NVD

5.4 (None) 5.4 (MEDIUM)

DescriptionCVE.org

Cross Site Scripting vulnerability in Juzaweb CMS v.5.0.0 allows a remote attacker via execute arbitrary code via a crafted script to the Add Banner Ads function

AnalysisAI

Stored cross-site scripting in Juzaweb CMS 5.0.0 allows authenticated remote attackers to inject arbitrary JavaScript via the Add Banner Ads function, exploitable with user interaction (page visit). The vulnerability enables credential theft, session hijacking, and defacement of administrative interfaces. A proof-of-concept is publicly available on GitHub, though exploitation requires authenticated access and victim interaction with a malicious payload.

Technical ContextAI

The vulnerability exploits improper input sanitization in the Banner Ads management feature (CWE-79: Improper Neutralization of Input During Web Page Generation). User-supplied input in the Add Banner Ads function is not adequately escaped before being rendered in HTML context, allowing attackers to inject <script> tags or event handlers. The CVSS vector reflects network accessibility (AV:N), low attack complexity (AC:L), and requirement for authenticated access (PR:L) combined with required user interaction (UI:R) - a user (typically an administrator) must visit a page containing the injected payload for the script to execute. Scope is changed (S:C), meaning the XSS can affect resources beyond the vulnerable component itself, such as other administrative functions or the broader application state.

RemediationAI

Primary mitigation is to upgrade Juzaweb CMS to a patched version released after CVE-2026-36358 disclosure; however, no specific fixed version is confirmed in available references - contact Juzaweb directly via https://juzaweb.com/ for patch availability and timeline. As immediate compensating controls, restrict access to the Banner Ads management function to a minimal set of trusted administrators using role-based access control, implement Content Security Policy (CSP) headers with script-src 'self' to prevent injection of external scripts, and enable output encoding of all user-supplied input in the Banner Ads feature by reviewing and hardening the template rendering logic. Organizations unable to patch should apply Web Application Firewall (WAF) rules to block <script> tags and event handlers (onerror, onload, onclick, etc.) in POST/PUT requests to the /admin/*banner* endpoints; note that WAF rules may be bypassed by encoding techniques and do not address the root cause. Consider disabling the Banner Ads feature entirely if it is not critical to operations.