EUVD-2026-64720
Cross-site Scripting (XSS) (CWE-79)
GHSA-vj8r-qh6m-h2x7
6.2
CVSS 4.0 · Vendor: twcert
Share
Severity by source
Vendor (twcert)
PRIMARY
6.2
HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today
AI
5.4
MEDIUM
Network-delivered stored XSS requires low-privilege auth (PR:L) and victim click (UI:R); scope change to victim session with limited C/I impact, no availability impact.
3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Primary rating from Vendor (twcert).
CVSS VectorVendor: twcert
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
A
Scope
X
Lifecycle Timeline
3
Analysis Generated
Aug 24, 2026 - 04:38 vuln.today
Severity Changed
Aug 24, 2026 - 04:22 NVD
HIGH
MEDIUM
CVSS changed
Aug 24, 2026 - 04:22 NVD
8.7 (HIGH)
6.2 (MEDIUM)
DescriptionCVE.org
Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content.
AnalysisAI
Stored XSS in Heptabase by Hepta Platforms, Inc. allows authenticated attackers to inject persistent malicious JavaScript into specific application pages, which then executes in the browsers of other users who interact with the crafted content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Recon
Authenticate to Heptabase with low-privilege account
Delivery
Identify specific injectable page type
Exploit
Inject persistent JavaScript payload into page content
Install
Share or link crafted page to target user
C2
Victim clicks crafted content
Execute
Malicious script executes in victim's browser
Impact
Exfiltrate session tokens or perform actions as victim
Recon
Authenticate to Heptabase with low-privilege account
Delivery
Identify specific injectable page type
Exploit
Inject persistent JavaScript payload into page content
Install
Share or link crafted page to target user
C2
Victim clicks crafted content
Execute
Malicious script executes in victim's browser
Impact
Exfiltrate session tokens or perform actions as victim
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid authenticated Heptabase account with at minimum low-level privileges (PR:L per CVSS 4.0); unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 6.2 (AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N) characterizes this as medium severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid low-privilege Heptabase account navigates to a specific injectable page type and inserts a crafted payload containing malicious JavaScript, which the application persists to its backend. The attacker then shares or links this page to target users on the same platform; when a victim clicks the content, the script silently executes in their browser under Heptabase's origin, enabling session token theft, unauthorized actions on behalf of the victim, or further payload delivery. … |
| Remediation | Consult the TWCERT advisories at https://www.twcert.org.tw/tw/cp-132-11125-9d359-1.html (Chinese) and https://www.twcert.org.tw/en/cp-139-11124-b8b51-2.html (English) for any released patched version; no specific fixed version number was present in the available intelligence data, so patch version should be confirmed directly with Hepta Platforms, Inc. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).