EUVD-2026-94983
GHSA-95jq-mxqx-3p79
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliverySubmit crafted script payload to stored field
-
ExploitPayload persisted without neutralization
-
ExecutionVictim views affected page
-
ImpactScript executes in victim browser session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization HTML tag escaping
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account (PR:L) on the Eimzamip application with the ability to write into a persisted input field that is later rendered to other users without HTML neutralization, and it requires a second victim user to view the page containing the stored payload (UI:R). These two factors - authentication and the need for victim interaction with the stored content - materially limit real-world exploitation and rule out unauthenticated or fully automated mass attacks. Affected deployments are those running Eimzamip versions from v1.6.4 up to (but not including) v1.6.7. |
| Impact | This is a low-severity stored XSS (CVSS 3.5, CWE-80) that does not rise to priority status. Every exploitation signal points the same direction: EPSS is not provided but SSVC from CISA explicitly rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', and there is no CISA KEV listing and no public exploit identified. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) reinforces this: although network-reachable and low-complexity, it requires an authenticated attacker (PR:L) AND victim interaction (UI:R), with only low confidentiality impact and no integrity or availability impact. The signals are consistent, not conflicting - a genuinely low-urgency, defense-in-depth fix rather than an emergency. The one judgment call is scope: basic stored XSS executes in a victim's browser context, which some assessors score as S:C (scope change); the input uses S:U, which modestly understates the cross-user nature of the flaw. No EPSS score was provided to independently gauge exploitation probability. |
| Exploit ScenarioDerived | An authenticated low-privilege user of the Eimzamip application submits a form or profile field containing a crafted script-bearing HTML payload that is stored by the server without proper neutralization. When another user (e.g., an administrator or fellow user) later views the page rendering that stored data, the script executes in their browser session, potentially stealing session tokens or performing actions as them. No public proof-of-concept exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Stored cross-site scripting in Eimzamip versions v1.6.4 up to but not including v1.6.7 allows an authenticated user to persist script-related HTML into a field that is later rendered to other users without neutralization. Exploitation requires a valid low-privileged account (PR:L per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N vector) plus a second user who views the poisoned page (UI:R), so unauthenticated or fully automated mass attacks are not possible. At CVSS 3.5 this is a low-severity issue; no public exploit has been identified at time of analysis, and CISA's SSVC decision data records Exploitation: none and Automatable: no.
RemediationAI
Upgrade Eimzamip to v1.6.7 or later - the advisory range places the fix boundary at v1.6.7, which is the first version not listed as affected - and confirm the new build before retiring any interim controls; the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1275 should be consulted for vendor-specific guidance. Where upgrading cannot be done immediately, the most effective compensating control is server-side output encoding (HTML-entity encoding of stored fields at render time, or a sanitization library that strips script-related tags) applied to every persisted field that is displayed to other users; note that this can visibly change how legitimate markup renders in records that previously accepted HTML. A restrictive Content-Security-Policy that disallows inline and third-party scripts reduces the impact of any residual stored payload, with the trade-off that it may break inline scripts in the application or its integrations. Because exploitation requires a low-privileged authenticated writer (PR:L), tightening which roles can write to persisted fields and auditing stored content for injected tags limits the attack surface, though it does not fix the missing neutralization. Marking session cookies HttpOnly and SameSite further blunts cookie theft from any surviving payload. Given the SSVC result (Exploitation: none, Automatable: no, Technical Impact: partial) and the low CVSS base score of 3.5, remediation should be scheduled as routine maintenance rather than emergency change.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic stored (persistent) cross-site scripting class issue mapped to CWE-80, 'Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)'. The underlying defect is that user-supplied content written into a persisted field is stored and later re-rendered to other users without HTML entity encoding, tag sanitization, or context-aware output escaping, allowing script-related tags to survive into the DOM of the victim's page. Because the payload is stored server-side rather than reflected, a single write can affect every user who subsequently views the compromised record. The CPE string cpe:2.3:a:i̇zometri_it_services_domestic_and_foreign_trade_co._ltd.:eimzamip:*:*:*:*:*:*:*:* identifies the affected application as Eimzamip, published by Turkish vendor İzometri IT Services Domestic and Foreign Trade Co. Ltd.; the CPE is wildcarded on version, so the authoritative affected range comes from the advisory data (v1.6.4 through v1.6.6). Discovery and disclosure are attributed to TR-CERT (EUVD-2026-94983, TR-26-1275), and SSVC rates the technical impact as partial with no automatable exploitation path.
Know when Eimzamip gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Authenticated attacker stores payload (PR:L) executed only when a victim loads the page (UI:R); stored XSS runs in the victim's browser across a trust boundary, so S:C with low C/I and no availability impact.
Primary rating from Vendor (TR-CERT).
CVSS VectorNVD
DescriptionNVD
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Stored XSS.
This issue affects eimzamip: from v1.6.4 before v1.6.7.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB