CVE-2026-45231CWE-79

DumbAssets 1.0.11 Stored Cross-Site Scripting via Asset Fields

Medium · published May 18, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
22.7
In the wild
Unconfirmed
What it is

DumbAssets through 1.0.11 contains a stored cross-site scripting vulnerability in asset fields including name, description, modelNumber, serialNumber, and tags that are stored without server-side sanitization and rendered using innerHTML without client-side escaping. Attackers can create or update assets with HTML or JavaScript payloads via the asset API endpoints to execute arbitrary scripts in the browsers of users viewing the asset list, and with Content-Security-Policy disabled, the injected scripts can make unrestricted connections to internal network services.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00310 · 22.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-05-18T18:40Z
EPSS history
Timeline
  • 18 MAY 18:40Z
    DumbAssets 1.0.11 Stored Cross-Site Scripting via Asset Fields
    cvelistv5