CVE-2026-1819CWE-79

Stored XSS in Karel Electronics' ViPort

High · published February 4, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
30.5
In the wild
Unconfirmed
What it is

⚡ Watch out! Stored XSS is lurking in ViPort, and it’s ready to wreak havoc on your web applications! 🤖 Think of this vulnerability like a sneaky chef who alters a recipe without anyone noticing. Just like a dish can be ruined by unverified ingredients, an attacker can inject malicious scripts into your web pages, leading users to unsafe experiences. An exploit could allow attackers to execute scripts in the context of the user's browser. This means they could steal sensitive data, hijack user sessions, or even spread malware—talk about a recipe for disaster! 🍽️

Put simply

Think of this vulnerability like a sneaky chef who alters a recipe without anyone noticing. Just like a dish can be ruined by unverified ingredients, an attacker can inject malicious scripts into your web pages, leading users to unsafe experiences. This vulnerability arises due to improper neutralization of user input during web page generation, allowing harmful scripts to be stored and executed later when other users access the compromised pages.

What to do

An exploit could allow attackers to execute scripts in the context of the user's browser. This means they could steal sensitive data, hijack user sessions, or even spread malware—talk about a recipe for disaster! 🍽️ Update ViPort to the latest version to patch this vulnerability. Additionally, implement input validation and output encoding practices to minimize the risk of XSS attacks. Regularly audit your web applications for potential vulnerabilities as a best practice. You've got this! Patch up that ViPort vulnerability and keep your web applications safe! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00377 · 30.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-02-04T07:52Z
EPSS history
Timeline
  • 04 FEB 07:52Z
    Stored XSS in Karel Electronics' ViPort
    cvelistv5