EUVD-2026-27826
GHSA-5qfh-xfvx-w63g
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Cross Site Scripting vulnerability in Juzaweb CMS v.5.0.0 allows a remote attacker via execute arbitrary code via a crafted script to the Add Banner Ads function
AnalysisAI
Stored cross-site scripting in Juzaweb CMS 5.0.0 allows authenticated remote attackers to inject arbitrary JavaScript via the Add Banner Ads function, exploitable with user interaction (page visit). The vulnerability enables credential theft, session hijacking, and defacement of administrative interfaces. A proof-of-concept is publicly available on GitHub, though exploitation requires authenticated access and victim interaction with a malicious payload.
Technical ContextAI
The vulnerability exploits improper input sanitization in the Banner Ads management feature (CWE-79: Improper Neutralization of Input During Web Page Generation). User-supplied input in the Add Banner Ads function is not adequately escaped before being rendered in HTML context, allowing attackers to inject <script> tags or event handlers. The CVSS vector reflects network accessibility (AV:N), low attack complexity (AC:L), and requirement for authenticated access (PR:L) combined with required user interaction (UI:R) - a user (typically an administrator) must visit a page containing the injected payload for the script to execute. Scope is changed (S:C), meaning the XSS can affect resources beyond the vulnerable component itself, such as other administrative functions or the broader application state.
RemediationAI
Primary mitigation is to upgrade Juzaweb CMS to a patched version released after CVE-2026-36358 disclosure; however, no specific fixed version is confirmed in available references - contact Juzaweb directly via https://juzaweb.com/ for patch availability and timeline. As immediate compensating controls, restrict access to the Banner Ads management function to a minimal set of trusted administrators using role-based access control, implement Content Security Policy (CSP) headers with script-src 'self' to prevent injection of external scripts, and enable output encoding of all user-supplied input in the Banner Ads feature by reviewing and hardening the template rendering logic. Organizations unable to patch should apply Web Application Firewall (WAF) rules to block <script> tags and event handlers (onerror, onload, onclick, etc.) in POST/PUT requests to the /admin/*banner* endpoints; note that WAF rules may be bypassed by encoding techniques and do not address the root cause. Consider disabling the Banner Ads feature entirely if it is not critical to operations.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today