What is the CVSS score of EUVD-2026-51183?

EUVD-2026-51183 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Apache JSPWiki are affected by EUVD-2026-51183?

Apache JSPWiki (versions through 2.12.3) contains a vulnerability that allows page editors to compromise other users' sessions and steal sensitive data; no public exploit has been identified at time…

How to fix or mitigate EUVD-2026-51183?

Within 24 hours, inventory all Apache JSPWiki deployments, identify current versions, and assess the breadth of page-editing privileges and sensitive data exposure. Within 7 days, upgrade all JSPWiki instances to version 2.12.4 (vendor-released patch); if immediate patching is not feasible, restrict page-editing privileges to a minimal trusted group and monitor edit logs for suspicious activity. Within 30 days, verify upgrade completion across all deployments, implement content security policy headers as additional XSS defense, and review active sessions for potential compromise.

Apache JSPWiki EUVD-2026-51183

| CVE-2026-48910 MEDIUM

Basic XSS (CWE-80)

2026-07-30

GHSA-g956-w8r6-2m72

XSS Apache

6.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.4 MEDIUM

Network-accessible wiki requires edit-level privileges (PR:L); victim must render the error output (UI:R); XSS crosses from server to browser scope (S:C); impact limited to browser-side info disclosure and script injection (C:L/I:L), no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jul 30, 2026 - 17:22 NVD

6.5 (MEDIUM)

Analysis Generated

Jul 30, 2026 - 14:16 vuln.today

CVE Published

Jul 30, 2026 - 13:56 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical XSS in Jenkins - CVE-2026-48910 Jul 30, 2026

AnalysisAI

Cross-site scripting in Apache JSPWiki's Markdown renderer error-handling path allows attackers with page-editing access to inject JavaScript that executes in victims' browsers, enabling session data theft and sensitive information exfiltration. All Apache JSPWiki releases through 2.12.3 are affected; the Apache Software Foundation has confirmed version 2.12.4 as the fix. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain JSPWiki page-editing access

Delivery

Craft Markdown input designed to trigger parser error

Exploit

Submit malicious editing request to vulnerable instance

Execution

Victim loads page or error output in browser

Persist

Unescaped XSS payload executes in victim browser context

Impact

Exfiltrate session tokens or sensitive information

Access

Obtain JSPWiki page-editing access

Delivery

Craft Markdown input designed to trigger parser error

Exploit

Submit malicious editing request to vulnerable instance

Execution

Victim loads page or error output in browser

Persist

Unescaped XSS payload executes in victim browser context

Impact

Exfiltrate session tokens or sensitive information

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the attacker hold page-editing permissions on the target JSPWiki instance; in deployments with open registration or anonymous editing enabled, this bar may be low, but in access-controlled or read-only deployments it is a meaningful prerequisite. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	No CVSS vector or numeric score was published in the advisory, and no EPSS data was provided, so quantitative risk signals are absent from the source data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with JSPWiki page-editing access submits a carefully crafted Markdown snippet engineered to trigger a parsing error in versions through 2.12.3. When a victim such as a wiki administrator or another editor views the affected page or error output rendered by the Markdown engine, the unescaped JavaScript payload executes in their browser, allowing the attacker to steal session cookies or extract other sensitive information. …
Remediation	Upgrade Apache JSPWiki to version 2.12.4 or later as directed by the Apache Software Foundation advisory at https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2026-48910. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Apache JSPWiki deployments, identify current versions, and assess the breadth of page-editing privileges and sensitive data exposure. …

Threat intelligence, references, and detailed analysis are available after sign-in.