CVE-2026-22198

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22198", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-01-06T16:47:17.184Z", "datePublished": "2026-01-09T16:19:11.386Z", "dateUpdated": "2026-03-05T01:30:15.900Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "GestSup", "vendor": "GestSup", "versions": [{"lessThan": "3.2.60", "status": "affected", "version": "0", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gestsup:gestsup:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.2.60"}]}]}], "credits": [{"lang": "en", "type": "finder", "value": "Geoffrey Robert and Valentin Holubec of Akailabs"}, {"lang": "en", "type": "coordinator", "value": "VulnCheck"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "GestSup versions prior to&nbsp;3.2.60 contain a pre-authentication stored cross-site scripting (XSS) vulnerability in the API error logging functionality. By sending an API request with a crafted X-API-KEY header value (for example, to /api/v1/ticket.php), an unauthenticated attacker can cause attacker-controlled HTML/JavaScript to be written to log entries. When an administrator later views the affected logs in the web interface, the injected content is rendered without proper output encoding, resulting in arbitrary script execution in the administrator\u2019s browser session.<br>"}], "value": "GestSup versions prior to\u00a03.2.60 contain a pre-authentication stored cross-site scripting (XSS) vulnerability in the API error logging functionality. By sending an API request with a crafted X-API-KEY header value (for example, to /api/v1/ticket.php), an unauthenticated attacker can cause attacker-controlled HTML/JavaScript to be written to log entries. When an administrator later views the affected logs in the web interface, the injected content is rendered without proper output encoding, resulting in arbitrary script execution in the administrator\u2019s browser session."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-05T01:30:15.900Z"}, "references": [{"tags": ["release-notes"], "url": "https://gestsup.fr/index.php?page=changelog"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/gestsup-stored-xss-in-api-error-logs"}], "source": {"discovery": "UNKNOWN"}, "title": "GestSup < 3.2.60 Stored XSS in API Error Logs", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-09T17:47:50.637948Z", "id": "CVE-2026-22198", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T18:37:21.402Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22198", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-09T17:47:50.637948Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-09T17:47:53.707Z"}}], "cna": {"title": "GestSup < 3.2.60 Stored XSS in API Error Logs", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Geoffrey Robert and Valentin Holubec of Akailabs"}, {"lang": "en", "type": "coordinator", "value": "VulnCheck"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "GestSup", "product": "GestSup", "versions": [{"status": "affected", "version": "0", "lessThan": "3.2.60", "versionType": "semver"}], "defaultStatus": "unknown"}], "references": [{"url": "https://gestsup.fr/index.php?page=changelog", "tags": ["release-notes"]}, {"url": "https://www.vulncheck.com/advisories/gestsup-stored-xss-in-api-error-logs", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "GestSup versions prior to\u00a03.2.60 contain a pre-authentication stored cross-site scripting (XSS) vulnerability in the API error logging functionality. By sending an API request with a crafted X-API-KEY header value (for example, to /api/v1/ticket.php), an unauthenticated attacker can cause attacker-controlled HTML/JavaScript to be written to log entries. When an administrator later views the affected logs in the web interface, the injected content is rendered without proper output encoding, resulting in arbitrary script execution in the administrator\u2019s browser session.", "supportingMedia": [{"type": "text/html", "value": "GestSup versions prior to&nbsp;3.2.60 contain a pre-authentication stored cross-site scripting (XSS) vulnerability in the API error logging functionality. By sending an API request with a crafted X-API-KEY header value (for example, to /api/v1/ticket.php), an unauthenticated attacker can cause attacker-controlled HTML/JavaScript to be written to log entries. When an administrator later views the affected logs in the web interface, the injected content is rendered without proper output encoding, resulting in arbitrary script execution in the administrator\u2019s browser session.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-01-14T16:22:23.313Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22198", "state": "PUBLISHED", "dateUpdated": "2026-01-14T16:22:23.313Z", "dateReserved": "2026-01-06T16:47:17.184Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-01-09T16:19:11.386Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "GestSup", "vendor": "GestSup", "versions": [{"lessThan": "3.2.60", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gestsup:gestsup:*:*:*:*:*:*:*:*", "matchCriteriaId": "42882370-536F-4C20-B766-1729C16A0021", "versionEndIncluding": "3.2.56", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GestSup versions prior to\u00a03.2.60 contain a pre-authentication stored cross-site scripting (XSS) vulnerability in the API error logging functionality. By sending an API request with a crafted X-API-KEY header value (for example, to /api/v1/ticket.php), an unauthenticated attacker can cause attacker-controlled HTML/JavaScript to be written to log entries. When an administrator later views the affected logs in the web interface, the injected content is rendered without proper output encoding, resulting in arbitrary script execution in the administrator\u2019s browser session."}, {"lang": "es", "value": "Las versiones de GestSup anteriores a la 3.2.60 contienen una vulnerabilidad de cross-site scripting (XSS) almacenado de preautenticaci\u00f3n en la funcionalidad de registro de errores de la API. Al enviar una solicitud de API con un valor de encabezado X-API-KEY manipulado (por ejemplo, a /api/v1/ticket.php), un atacante no autenticado puede hacer que HTML/JavaScript controlado por el atacante se escriba en las entradas de registro. Cuando un administrador ve posteriormente los registros afectados en la interfaz web, el contenido inyectado se renderiza sin una codificaci\u00f3n de salida adecuada, lo que resulta en la ejecuci\u00f3n arbitraria de scripts en la sesi\u00f3n del navegador del administrador."}], "id": "CVE-2026-22198", "lastModified": "2026-06-17T10:19:31.860", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22198", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-09T17:47:50.637948Z", "version": "2.0.3"}}]}, "published": "2026-01-09T17:15:55.310", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Release Notes"], "url": "https://gestsup.fr/index.php?page=changelog"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/gestsup-stored-xss-in-api-error-logs"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-16T18:25:23.909403+00:00", "value": {"mitigation_remediation": ["Upgrade GestSup to version 3.2.60 or later to remove the stored XSS flaw.", "If an upgrade is not immediately possible, configure the application to disable or properly sanitize API error logging so that any stored payload is escaped or omitted before display.", "Monitor error logs for anomalous entries containing scripts or unusual X\u2011API\u2011KEY values and investigate any suspicious activity."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary script execution in an administrator\u2019s browser session via stored XSS"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the GestSup product, specifically all releases prior to version 3.2.60. No other products or vendors are listed as affected.", "description_and_impact": "GestSup versions prior to 3.2.60 allow an attacker to inject attacker\u2011controlled HTML or JavaScript into API error logs by sending a crafted X\u2011API\u2011KEY header with an unauthenticated request. The injected payload is stored and later rendered in the web interface without proper output encoding, enabling arbitrary script execution in the administrators\u2019 browser, which can lead to session hijacking or other malicious actions.", "risk_and_exploitability": "The CVSS score of 5.1 classifies the issue as moderate severity, while the EPSS score of less than 1\u00a0% indicates a very low likelihood of exploitation at the time of analysis and the vulnerability is not listed in the CISA KEV catalog. The attack can be performed from any network location without authentication, typically by forging an HTTP request to the API endpoint (e.g., /api/v1/ticket.php). Because the payload is stored and executed only when an administrator views the log entries, the window of exploitation is limited to when privileged users access the logs. Nonetheless, the potential for compromising an admin session remains."}}}}, "created": "2026-01-12T14:37:07.602304+00:00", "updated": "2026-04-16T18:30:10.546421+00:00", "vendors": ["gestsup", "gestsup$PRODUCT$gestsup"]}