EUVD-2026-88640
GHSA-26qv-8fmw-h89f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliverySubmit XSS payload in Name/Address/City via update-account.php
-
ExploitPayload stored in profile
-
ExecutionVictim views profile page
-
ImpactScript executes in victim browser session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privilege account (PR:L) on the robo-cafe-rms application to submit the malicious payload through the Edit Profile Feature (frontend/update-account.php) via the Name, Address, or City parameters. Exploitation further depends on user interaction (UI:P) - a victim (e.g., another user or an admin) must view the page rendering the stored profile field for the script to execute. Exploitation is limited by the need for a valid account, the requirement that a victim load the affected view, and the product's very small deployment base; no unauthenticated path is indicated. |
| Impact | This is a low-to-moderate real-world risk. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N, score 5.1) describes a network-reachable but authenticated (PR:L) cross-site scripting flaw that additionally requires user interaction (UI:P) and yields only limited integrity impact (VI:L) with no confidentiality or availability impact - consistent with a garden-variety stored XSS in a profile-edit form. The 'E:P' exploit-maturity metric plus the description ('The exploit has been made public and could be used') indicate publicly available exploit code exists, but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation. The signals are internally consistent: a public POC but low CVSS and no KEV points to a documented, easily-reproducible bug rather than a high-value target. The dominant risk-limiting factor is prevalence - robo-cafe-rms is an obscure open-source project with negligible production footprint. Net: a genuine but low-priority XSS; not a high-CVSS-but-hidden-risk case, simply a low-severity issue in a rarely-deployed product. Note the vendor was contacted but did not respond, so no official patch is confirmed. |
| Exploit ScenarioDerived | An authenticated low-privilege user of the robo-cafe-rms application edits their profile via frontend/update-account.php and injects a script payload into the Name, Address, or City field. When another user or an administrator later views that profile data, the stored script executes in their browser session. A public POC is available (VulDB, exploit-maturity E:P), lowering the effort required to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Stored cross-site scripting in mwasikz robo-cafe-rms allows an authenticated low-privilege user to inject arbitrary script into the profile Name, Address, or City fields, which then executes in the browser of any victim who views the affected profile page. Publicly available exploit code exists, and because the project follows a rolling-release model, no version boundary or vendor patch can be cited for the affected or fixed code. The risk is low-to-moderate in practice: exploitation requires a valid account, the injected content only fires when another user loads the poisoned view, and the product has a very small deployment base. Vendor contact was attempted early in the disclosure process and produced no response.
RemediationAI
No vendor-released patch was identified at the time of analysis; the vendor was contacted early about the disclosure and did not respond, and the rolling-release model means there is no fixed version to upgrade to. The primary remediation is therefore code-level: apply context-aware output encoding (for example PHP htmlspecialchars with ENT_QUOTES on the Name, Address, and City values wherever they are rendered), and validate or reject HTML-bearing input on the server side in frontend/update-account.php rather than relying on client-side filtering; note that overly strict input rejection can break legitimate names and addresses containing apostrophes or non-Latin characters, so allow-list validation plus output encoding is preferred over blacklisting. As compensating controls, restrict account creation and the ability to edit profiles to trusted users, since exploitation requires an authenticated low-privilege account, and deploy a Content-Security-Policy header that disallows inline script and untrusted script origins on profile views to blunt execution of any stored payload, accepting that CSP will not help browsers or contexts where policies are bypassed and that it is only a mitigation. Administrators can additionally place the application behind authentication with network-level access restrictions and treat profile pages as untrusted output when reviewing logs for injected script, but the durable fix requires the maintainer to patch frontend/update-account.php; track https://vuldb.com/vuln/411166 and https://vuldb.com/cve/CVE-2026-102264 for any subsequent fix announcement.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Robo Cafe RMS is a PHP web application (the affected code path is frontend/update-account.php within the Edit Profile Feature), and the CPE record cpe:2.3:a:mwasikz:robo-cafe-rms:*:*:*:*:*:*:*:* carries a wildcard version, so every available revision of the rolling-release codebase is presumed affected up to commit 228c44a02823f04e85db32b7137809a2856148fc. The weakness is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning the application accepts the Name, Address, and City parameters during profile update and later renders them back into HTML without context-appropriate output encoding or sanitization, allowing a stored payload to break out of its intended context and execute as script. The CVE's operational vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P, and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) characterizes the same condition: a low-privilege authenticated account is required, the attacker's own confidentiality and availability are unaffected while the scope changes because the script runs in the victim's session context, and successful exploitation depends on a victim loading the tainted view. No unauthenticated exploitation path is indicated by the data.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Authenticated user (PR:L) stores XSS via profile fields; a victim must load the page (UI:R); script runs in the victim's browser context, crossing to another user's session (S:C) with limited C/I impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The impacted element is an unknown function of the file frontend/update-account.php of the component Edit Profile Feature. Performing a manipulation of the argument Name/Address/City results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB