What is the CVSS score of EUVD-2026-42953?

EUVD-2026-42953 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Mezunum Satiyorum EUVD-2026-42953

| CVE-2026-3251 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-10 TR-CERT

GHSA-q58p-r45f-cjqp

XSS Mezunum Satiyorum

6.4

CVSS 3.1 · Vendor: TR-CERT

Severity by source

Vendor (TR-CERT) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS requires victim page load (UI:R per CVSS guidance); PR:L confirmed; S:C and C:L/I:L reflect browser context impact with no availability effect.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (TR-CERT).

CVSS VectorVendor: TR-CERT

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 17:37 vuln.today

DescriptionCVE.org

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Webremium Istanbul Web Design Mezunum Satiyorum allows Stored XSS.

This issue affects Mezunum Satiyorum: from 1.2.504 through 10072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stored cross-site scripting in Mezunum Satiyorum (versions 1.2.504 through 10072026) allows a low-privileged authenticated attacker to inject persistent malicious scripts into web pages served to other users. The scope change (S:C) in the CVSS vector confirms the payload executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects against any user who loads the affected page. No public exploit code has been identified at time of analysis, and the vendor did not respond to TR-CERT's disclosure, leaving the vulnerability unpatched.

Technical ContextAI

Mezunum Satiyorum is a Turkish-language web application developed by Webremium Istanbul Web Design, as identified by CPE cpe:2.3:a:webremium_istanbul_web_design:mezunum_satiyorum:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is written to the DOM or HTTP response without adequate encoding or sanitization. Because the variant is Stored XSS, the payload is persisted server-side - likely in a database-backed user content field - and re-served to every subsequent visitor, amplifying impact compared to reflected XSS. The CVSS scope change (S:C) reflects that the injected script executes in the victim's browser security context, which is a distinct security boundary from the vulnerable web server component itself.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to TR-CERT's coordinated disclosure. Organizations using Mezunum Satiyorum should consider the following compensating controls: restrict write access to the affected content fields to the minimum necessary user population, reducing the attacker pool for stored payload injection. Deploying a Content Security Policy (CSP) header with a strict script-src directive (e.g., 'script-src self') can block inline script execution in victim browsers, though this may break legitimate application functionality and requires testing. A web application firewall (WAF) with XSS rule sets can be placed in front of the application to filter known XSS payloads in transit, but WAF bypass is possible and this is not a complete mitigation. Monitor TR-CERT advisory https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0525 for any updated guidance or vendor response.