CVE-2026-32774CWE-79cross-site-scripting

CVE-2026-32774

Medium · published March 16, 2026

CVSS v3.1
6.4
EPSS
0%
Percentile
19.6
In the wild
Unconfirmed
What it is

Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browsers.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00282 · 19.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-16T18:19Z
Affected products (1)
ProductVersionsFixed in
vulnogram/vulnogramall versions—
References (4)
https://github.com/Vulnogram/Vulnogram · [email protected]https://github.com/Vulnogram/Vulnogram/security/advisories/GHSA-pg4p-2985-gvxr · [email protected]https://www.vulncheck.com/advisories/vulnogram-stored-cross-site-scripting-via-comment-hypertext · [email protected]https://github.com/Vulnogram/Vulnogram/commit/2f0e21b113c58124084c7b74c9768fc241126a05 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 14 MAR 21:44Z
    Vulnogram - Stored Cross-Site Scripting via Comment Hypertext
    cvelistv5