{"items":[{"id":"NVI-00005332","kind":"vulnerability","title":"NukeViet: Unauthenticated Reflected XSS in Comment Module","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-mxpf-qgg6-v3ff","CVE-2026-48118"],"plain_summary":"OSV carries this publisher advisory for nukeviet/nukeviet. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 4.6.00 for nukeviet/nukeviet. Confirm the publisher’s latest guidance.","source_ids":["sr-8b2d7749196362073866eaf463011bf7"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-8b2d7749196362073866eaf463011bf7","url":"https://github.com/advisories/GHSA-mxpf-qgg6-v3ff","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-mxpf-qgg6-v3ff","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:30.984Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-8b2d7749196362073866eaf463011bf7"],"technology":"nukeviet/nukeviet","known_exclusions":[],"conditions_summary":"## Summary\n\nReflected XSS in the Comment module via the `status_comment` URL parameter. The parameter accepts attacker-controlled base64-encoded HTML/JavaScript that is decoded server-side and rendered unescaped into the page. Compounded by a second flaw: the `checkss` anti-forgery token was derived from a site-wide static value (`NV_CACHE_PREFIX`) instead of a per-session value, making the token reusable across all users and allowing the attack to be delivered via a simple crafted URL.\n\n## Details\n\n### Vulnerability 1 — Reflected XSS via `status_comment`\n\n**Affected components:**\n- `modules/comment/funcs/main.php` — parameter ingestion\n- `modules/comment/comment.php` — decode and template assignment\n- `themes/*/modules/comment/comment.tpl` — raw render\n\nThe `status_comment` GET/POST parameter is sanitised with `get_title()`, which applies `strip_tags()`. Because the parameter is intended to carry a base64-encoded string, its character set (`[A-Za-z0-9-_,]`) passes through `strip_tags()` unchanged. The value is later decoded with `nv_base64_decode()` and assigned to the template variable `STATUS_COMMENT` **without any escaping**, which the template then renders raw inside a ``","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 4.6.00"]}],"null_published_at":"2026-10-31T22:13:01.460Z","source_updated_at":"2026-07-13T17:41:46.627Z","source_disclosed_at":"2026-07-13T17:21:07.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:30.984Z"}],"next_cursor":null,"snapshot_revision":"42594"}