EUVD-2026-41758
GHSA-pw2m-p9pg-9xr6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable XSS requiring authenticated attacker (PR:L) and victim interaction (UI:R); scope changes as script executes in victim browser, yielding limited C and I impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This affects the function add_definition of the file application/PHP/objects/notes/add_into_dictionary.php. Such manipulation of the argument reference leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Cross-site scripting in stumasy's dictionary notes feature allows a low-privileged, remote attacker to inject malicious JavaScript via the unsanitized reference argument of the add_definition function. The vulnerability affects the PHP web application at commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be and earlier, with exploit code publicly disclosed via VulDB submission 849495. Real-world impact is constrained by the requirement for prior authentication and victim interaction, but no vendor patch exists and the project maintainer has not responded to the responsible disclosure.
Technical ContextAI
stumasy is a PHP-based web application hosted on GitHub (github.com/mjperpinosa/stumasy) that includes a dictionary/notes subsystem. The vulnerable code resides in application/PHP/objects/notes/add_into_dictionary.php within the add_definition function. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied input - specifically the reference argument - is reflected back into an HTML response without adequate encoding or sanitization, enabling injection of arbitrary client-side script. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) confirms a network-reachable endpoint with no special attack preconditions beyond authentication and passive victim interaction. No CPE string was issued, consistent with the project's rolling-release model and lack of versioned releases.
RemediationAI
No vendor-released patch has been identified at time of analysis; the project maintainer has not responded to the responsible disclosure reported via GitHub issue #8 (https://github.com/mjperpinosa/stumasy/issues/8). Organizations running stumasy should apply output encoding (e.g., PHP htmlspecialchars()) to the reference parameter before rendering it in HTML responses, which can be implemented as a local patch to add_into_dictionary.php. As a compensating control, restrict access to the dictionary/notes endpoint to trusted authenticated users only via application-level or web server access controls - note this does not fix the underlying flaw but reduces the attacker pool. Disabling the add_into_dictionary feature entirely eliminates exposure if the functionality is non-essential. Monitor VulDB entry 376341 (https://vuldb.com/vuln/376341) for any future patch release.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today