CVE-2026-41575CWE-79CWE-80

th30d4y/IP: DOM-Based Cross-Site Scripting (XSS) Vulnerability

Medium · published May 8, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
15.8
In the wild
Unconfirmed
What it is

In th30d4y/IP from version 1.0.1 to before version 2.0.1, a DOM-Based Cross-Site Scripting (XSS) vulnerability was identified in an IP Reputation Checker application. Unsanitized user input was directly rendered in the browser, allowing attackers to execute arbitrary JavaScript. This issue has been patched in version 2.0.1.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00253 · 15.8th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2026-05-08T14:42Z
EPSS history
Timeline
  • 08 MAY 14:42Z
    th30d4y/IP: DOM-Based Cross-Site Scripting (XSS) Vulnerability
    cvelistv5