{"items":[{"id":"NVI-00002490","kind":"vulnerability","title":"Craft CMS: Stored XSS via Structure entry title in table view","revision":4,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-xrqc-p465-2xvg","CVE-2026-55793"],"plain_summary":"OSV carries this publisher advisory for craftcms/cms. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 5.9.53 for craftcms/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-1adbc97fc2f7d79978bfa26c27a69f3d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-3562fcd66e10893a1fcf40a7a77fed78"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-25T16:10:00.147Z","value":"5.9 MEDIUM (4.0)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-03b0323d7079bb08f8604d5c5c1f747f"},{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.318%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.24804. Missing scores are unknown.","source_id":"sr-3562fcd66e10893a1fcf40a7a77fed78"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1adbc97fc2f7d79978bfa26c27a69f3d","url":"https://github.com/advisories/GHSA-xrqc-p465-2xvg","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-xrqc-p465-2xvg","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:51.448Z"},{"id":"sr-03b0323d7079bb08f8604d5c5c1f747f","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55793","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-55793","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-01T07:24:39.943Z"},{"id":"sr-3562fcd66e10893a1fcf40a7a77fed78","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-55793","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:28:32.283Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1adbc97fc2f7d79978bfa26c27a69f3d"],"technology":"craftcms/cms","known_exclusions":[],"conditions_summary":"# Stored XSS via Structure entry title in table view\n\n## Summary\n\nAn Author-level control panel user can store a JavaScript payload in an entry title. When an admin, or any control panel user with `saveEntries` for the same Structure section, drags another entry under the poisoned entry in table view, the payload executes in the victim’s session.\n\nThe issue is exploitable because the title is escaped into `data-title` by the server, decoded again by the browser, read with jQuery `.data('title')`, and then concatenated into a new HTML string without attribute escaping.\n\nExecution was verified with `alert(document.domain)`. Impact was verified against an elevated admin session by changing the admin user’s email through `users/save-user`, then using the password-reset flow to take over the account.\n\n## Preconditions\n\n- Attacker has `createEntries` + `saveEntries` on a Structure-type section (Author-style CP account; no admin permission required).\n- Victim has `saveEntries` on the same section. Craft only renders drag handles when `structureEditable` is true, which requires this permission, so any admin qualifies.\n- Section must be type Structure. Channel and Single sections are unaffe","public_affected_ranges":["ECOSYSTEM: introduced 5.0.0-RC1; fixed 5.9.53"]}],"null_published_at":"2026-11-07T18:43:15.099Z","source_updated_at":"2026-09-10T03:51:12.649Z","source_disclosed_at":"2026-07-06T21:35:02.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:42:51.448Z"},{"id":"NVI-00002490","kind":"vulnerability","title":"Craft CMS: Stored XSS via Structure entry title in table view","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-xrqc-p465-2xvg","CVE-2026-55793"],"plain_summary":"OSV carries this publisher advisory for craftcms/cms. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 5.9.53 for craftcms/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-1adbc97fc2f7d79978bfa26c27a69f3d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-38a84d17398e7d3651799d403b154df7"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-25T16:10:00.147Z","value":"5.9 MEDIUM (4.0)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-03b0323d7079bb08f8604d5c5c1f747f"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.318%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.2481. Missing scores are unknown.","source_id":"sr-38a84d17398e7d3651799d403b154df7"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1adbc97fc2f7d79978bfa26c27a69f3d","url":"https://github.com/advisories/GHSA-xrqc-p465-2xvg","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-xrqc-p465-2xvg","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:51.448Z"},{"id":"sr-03b0323d7079bb08f8604d5c5c1f747f","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55793","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-55793","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-01T07:24:39.943Z"},{"id":"sr-38a84d17398e7d3651799d403b154df7","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-55793","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.383Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1adbc97fc2f7d79978bfa26c27a69f3d"],"technology":"craftcms/cms","known_exclusions":[],"conditions_summary":"# Stored XSS via Structure entry title in table view\n\n## Summary\n\nAn Author-level control panel user can store a JavaScript payload in an entry title. When an admin, or any control panel user with `saveEntries` for the same Structure section, drags another entry under the poisoned entry in table view, the payload executes in the victim’s session.\n\nThe issue is exploitable because the title is escaped into `data-title` by the server, decoded again by the browser, read with jQuery `.data('title')`, and then concatenated into a new HTML string without attribute escaping.\n\nExecution was verified with `alert(document.domain)`. Impact was verified against an elevated admin session by changing the admin user’s email through `users/save-user`, then using the password-reset flow to take over the account.\n\n## Preconditions\n\n- Attacker has `createEntries` + `saveEntries` on a Structure-type section (Author-style CP account; no admin permission required).\n- Victim has `saveEntries` on the same section. Craft only renders drag handles when `structureEditable` is true, which requires this permission, so any admin qualifies.\n- Section must be type Structure. Channel and Single sections are unaffe","public_affected_ranges":["ECOSYSTEM: introduced 5.0.0-RC1; fixed 5.9.53"]}],"null_published_at":"2026-11-01T14:34:07.501Z","source_updated_at":"2026-09-10T03:51:12.649Z","source_disclosed_at":"2026-07-06T21:35:02.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:42:51.448Z"},{"id":"NVI-00002490","kind":"vulnerability","title":"Craft CMS: Stored XSS via Structure entry title in table view","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-xrqc-p465-2xvg","CVE-2026-55793"],"plain_summary":"OSV carries this publisher advisory for craftcms/cms. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 5.9.53 for craftcms/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-1adbc97fc2f7d79978bfa26c27a69f3d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-38a84d17398e7d3651799d403b154df7"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.318%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.2481. Missing scores are unknown.","source_id":"sr-38a84d17398e7d3651799d403b154df7"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1adbc97fc2f7d79978bfa26c27a69f3d","url":"https://github.com/advisories/GHSA-xrqc-p465-2xvg","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-xrqc-p465-2xvg","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:51.448Z"},{"id":"sr-38a84d17398e7d3651799d403b154df7","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-55793","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.383Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1adbc97fc2f7d79978bfa26c27a69f3d"],"technology":"craftcms/cms","known_exclusions":[],"conditions_summary":"# Stored XSS via Structure entry title in table view\n\n## Summary\n\nAn Author-level control panel user can store a JavaScript payload in an entry title. When an admin, or any control panel user with `saveEntries` for the same Structure section, drags another entry under the poisoned entry in table view, the payload executes in the victim’s session.\n\nThe issue is exploitable because the title is escaped into `data-title` by the server, decoded again by the browser, read with jQuery `.data('title')`, and then concatenated into a new HTML string without attribute escaping.\n\nExecution was verified with `alert(document.domain)`. Impact was verified against an elevated admin session by changing the admin user’s email through `users/save-user`, then using the password-reset flow to take over the account.\n\n## Preconditions\n\n- Attacker has `createEntries` + `saveEntries` on a Structure-type section (Author-style CP account; no admin permission required).\n- Victim has `saveEntries` on the same section. Craft only renders drag handles when `structureEditable` is true, which requires this permission, so any admin qualifies.\n- Section must be type Structure. Channel and Single sections are unaffe","public_affected_ranges":["ECOSYSTEM: introduced 5.0.0-RC1; fixed 5.9.53"]}],"null_published_at":"2026-10-31T22:27:15.293Z","source_updated_at":"2026-09-10T03:51:12.649Z","source_disclosed_at":"2026-07-06T21:35:02.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:42:51.448Z"},{"id":"NVI-00002490","kind":"vulnerability","title":"Craft CMS: Stored XSS via Structure entry title in table view","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-xrqc-p465-2xvg","CVE-2026-55793"],"plain_summary":"OSV carries this publisher advisory for craftcms/cms. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 5.9.53 for craftcms/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-1adbc97fc2f7d79978bfa26c27a69f3d"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1adbc97fc2f7d79978bfa26c27a69f3d","url":"https://github.com/advisories/GHSA-xrqc-p465-2xvg","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-xrqc-p465-2xvg","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:51.448Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1adbc97fc2f7d79978bfa26c27a69f3d"],"technology":"craftcms/cms","known_exclusions":[],"conditions_summary":"# Stored XSS via Structure entry title in table view\n\n## Summary\n\nAn Author-level control panel user can store a JavaScript payload in an entry title. When an admin, or any control panel user with `saveEntries` for the same Structure section, drags another entry under the poisoned entry in table view, the payload executes in the victim’s session.\n\nThe issue is exploitable because the title is escaped into `data-title` by the server, decoded again by the browser, read with jQuery `.data('title')`, and then concatenated into a new HTML string without attribute escaping.\n\nExecution was verified with `alert(document.domain)`. Impact was verified against an elevated admin session by changing the admin user’s email through `users/save-user`, then using the password-reset flow to take over the account.\n\n## Preconditions\n\n- Attacker has `createEntries` + `saveEntries` on a Structure-type section (Author-style CP account; no admin permission required).\n- Victim has `saveEntries` on the same section. Craft only renders drag handles when `structureEditable` is true, which requires this permission, so any admin qualifies.\n- Section must be type Structure. Channel and Single sections are unaffe","public_affected_ranges":["ECOSYSTEM: introduced 5.0.0-RC1; fixed 5.9.53"]}],"null_published_at":"2026-10-31T22:00:33.892Z","source_updated_at":"2026-09-10T03:51:12.649Z","source_disclosed_at":"2026-07-06T21:35:02.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:51.448Z"}],"next_cursor":null,"snapshot_revision":"42594"}