CVE-2026-129259
Mereithhh VanBlog Image Upload Endpoint access.ts cross site scripting
Published Nov 14, 2026
CVSS 4.0 · 5.1 Medium
EPSS n/a
KEV · Not listed
Description
A weakness has been identified in Mereithhh VanBlog up to 0.54.0. This affects an unknown part of the file packages/server/src/types/access/access.ts of the component Image Upload Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Products
-
CVE record
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Mereithhh | VanBlog | affected |
|
No data.
No data.
No data available yet.
Remediation
Tracking
Advisories
Metrics
Attack Vector Network
Attack Complexity Low
Privileges Required Low
Attack Requirements None
User Interaction Passive
Vulnerable System Confidentiality Impact None
Vulnerable System Integrity Impact Low
Vulnerable System Availability Impact None
Subsequent System Confidentiality Impact None
Subsequent System Integrity Impact None
Subsequent System Availability Impact None
Attack Vector Network
Attack Complexity Low
Privileges Required Low
Scope Unchanged
Confidentiality Impact None
Integrity Impact Low
Availability Impact None
User Interaction Required
Attack Vector Network
Attack Complexity Low
Privileges Required Low
Scope Unchanged
Confidentiality Impact None
Integrity Impact Low
Availability Impact None
User Interaction Required
Access Vector Network
Access Complexity Low
Authentication Single
Confidentiality Impact None
Integrity Impact Partial
Availability Impact None
This CVE is not in the KEV list.
No EPSS score available.
Key SSVC decision points have not yet been added.
References
History
Nov 14, 2026 3:00 PM
Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A weakness has been identified in Mereithhh VanBlog up to 0.54.0. This affects an unknown part of the file packages/server/src/types/access/access.ts of the component Image Upload Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | |
| Title | Mereithhh VanBlog Image Upload Endpoint access.ts cross site scripting | |
| First Time appeared |
Mereithhh
Mereithhh vanblog |
|
| Weaknesses | CWE-79 CWE-94 |
|
| CPEs | cpe:2.3:a:mereithhh:vanblog:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Mereithhh
Mereithhh vanblog |
|
| References |
| |
| Metrics |
cvssV2_0
|
