CVE-2026-102292CWE-79CWE-94cross-site-scriptingcode-injection

CVE-2026-102292

Medium · published September 29, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
19.6
In the wild
Unconfirmed
What it is

A flaw has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deeca27ab1fb9df0552ec76444547811. Affected by this issue is some unknown functionality of the file users.php. This manipulation of the argument Search causes cross site scripting. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Patch name: 6406308df9771d2fd477b56dafe4878dd846df6e. Applying a patch is the recommended action to fix this issue.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00282 · 19.6th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-09-29T10:16Z
References (7)
https://github.com/coolbeans1212/MateisHomePage-Website/ · [email protected]https://github.com/coolbeans1212/MateisHomePage-Website/commit/6406308df9771d2fd477b56dafe4878dd846df6e · [email protected]https://github.com/coolbeans1212/MateisHomePage-Website/issues/8 · [email protected]https://vuldb.com/cve/CVE-2026-102292 · [email protected]https://vuldb.com/submit/940461 · [email protected]https://vuldb.com/vuln/411182 · [email protected]https://vuldb.com/vuln/411182/cti · [email protected]
EPSS history
Timeline
  • 30 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 29 SEP 05:00Z
    coolbeans1212 MateisHomePage-Website users.php cross site scripting
    cvelistv5