What is the CVSS score of EUVD-2026-46139?

EUVD-2026-46139 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

fuint Member Marketing EUVD-2026-46139

| CVE-2026-51025 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-20 mitre

GHSA-x4px-49gq-7fcj

XSS RCE Java N A

6.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Unauthenticated network injection with no complexity barrier, but victim must view payload; scope change captures cross-origin browser session impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 16:29 vuln.today

CVSS changed

Jul 21, 2026 - 16:22 NVD

6.1 (MEDIUM)

CVE Published

Jul 20, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote attacker to execute arbitrary code via the ClientMessageController.java file

AnalysisAI

Cross-site scripting in fuint Member Marketing System v1.0 and earlier allows remote unauthenticated attackers to inject malicious JavaScript through the ClientMessageController component, executing within authenticated users' browser sessions when they view the compromised content. The CVSS 6.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-accessible, low-complexity injection requiring no authentication, with scope change indicating browser-context impact beyond the originating request. No public exploit has been confirmed at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

fuint Member Marketing System is a Java-based open-source member loyalty and marketing management platform, likely targeted at Chinese commercial retail environments. The vulnerable component, ClientMessageController.java, is a Java MVC controller class responsible for handling client-facing message or communication interactions within the platform. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause: user-supplied input received by this controller is not properly sanitized or output-encoded before being rendered in HTML responses, enabling injection of arbitrary script content. The CPE identifier is listed as n/a in NVD, indicating fuint is not formally catalogued in the National Vulnerability Database product dictionary, which limits automated tracking. The scope change (S:C) in the CVSS vector reflects that the injected script executes in the victim's browser context, potentially affecting resources beyond the originating server.

RemediationAI

No vendor-released patch has been identified at time of analysis for fuint Member Marketing System versions 1.0 and earlier. Organizations should monitor the official fuint project repository for security updates addressing this issue. As a compensating control, deploy a Web Application Firewall with XSS filtering rules targeting the client message submission endpoint handled by ClientMessageController - note that overly aggressive WAF rules risk blocking legitimate message content and should be tuned carefully. If the client message submission endpoint is accessible to unauthenticated users and this is not a required feature, restricting submission to authenticated sessions only would significantly reduce attack surface, though this may impact intended functionality. Implementing strict Content Security Policy (CSP) headers to restrict inline script execution provides meaningful defense-in-depth and limits XSS impact even if injection occurs. Reference: https://github.com/W000i/vuln/issues/4.