CVE-2026-82664CWE-79CWE-94cross-site-scriptingcode-injection

CVE-2026-82664

Medium · published August 31, 2026

CVSS v3.1
4.3
EPSS
1%
Percentile
47.4
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in yaojingang GEOFlow up to 2.1.0. This affects an unknown part of the file app/Http/Controllers/Site/HomeController.php of the component JSON-LD Theme Handler. The manipulation of the argument Search leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.1.1 is able to mitigate this issue. The identifier of the patch is 67abfd864a15d169a78429f3290c91cb3b93e849. Upgrading the affected component is recommended.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00588 · 47.4th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-31T13:17Z
References (9)
https://github.com/yaojingang/GEOFlow/ · [email protected]https://github.com/yaojingang/GEOFlow/commit/67abfd864a15d169a78429f3290c91cb3b93e849 · [email protected]https://github.com/yaojingang/GEOFlow/issues/60 · [email protected]https://github.com/yaojingang/GEOFlow/pull/61 · [email protected]https://github.com/yaojingang/GEOFlow/releases/tag/v2.1.1 · [email protected]https://vuldb.com/cve/CVE-2026-82664 · [email protected]https://vuldb.com/submit/893851 · [email protected]https://vuldb.com/vuln/397158 · [email protected]https://vuldb.com/vuln/397158/cti · [email protected]
EPSS history
Timeline
  • 01 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 31 AUG 08:00Z
    yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting
    cvelistv5