EUVD-2026-40067
GHSA-q74h-h8mf-f6rx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable stored XSS requiring low-privilege submission and admin view; scope changes to admin browser with limited confidentiality and integrity impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A security flaw has been discovered in CodeAstro Complaint Management System 1.0. This issue affects some unknown processing of the file /report/addreport of the component Report Handler. Performing a manipulation of the argument Report Title results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
AnalysisAI
Stored cross-site scripting in CodeAstro Complaint Management System 1.0 allows a low-privileged authenticated user to inject persistent malicious scripts via the Report Title field at the /report/addreport endpoint, which then execute in the context of any administrator who views the submitted report. The GitHub-published proof-of-concept confirms the payload is stored and surfaces in the admin panel, enabling session hijacking or admin-context actions without further attacker interaction after initial submission. A public exploit has been released; however, no active exploitation has been confirmed by CISA KEV.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) describes the root cause: the Report Handler component at /report/addreport in CodeAstro Complaint Management System 1.0 fails to sanitize or encode user-supplied input in the Report Title field before persisting it to the database and subsequently rendering it in the administrative interface. Because the payload is stored rather than reflected, exploitation is deferred to when a privileged user loads the affected view, making this a persistent (stored) XSS variant. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) confirms network reachability with no attack prerequisites beyond a low-privilege account, and passive user interaction (an administrator viewing the report). No CPE string was provided in the source data, so affected version identification is limited to the vendor page at codeastro.com and the VulDB entry.
RemediationAI
The primary fix is to apply output encoding and server-side input sanitization to the Report Title field in the Report Handler component at /report/addreport, ensuring user-supplied HTML special characters are neutralized before storage and before rendering in the admin panel. No vendor-released patch or patched version number has been identified in the available data - affected organizations should contact CodeAstro directly via https://codeastro.com/ and reference CVE-2026-13558. As a compensating control, restrict access to the /report/addreport endpoint to only fully trusted and vetted user accounts, reducing the population of principals who can submit report entries. Implementing a Content Security Policy (CSP) header that blocks inline script execution will materially reduce the impact of stored XSS payloads, though it does not remediate the root input-handling defect. Administrators should audit existing stored report titles for suspicious script content and clear any that contain HTML or JavaScript.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today