CVE-2026-30919

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30919", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-07T16:40:05.884Z", "datePublished": "2026-03-09T22:54:49.645Z", "dateUpdated": "2026-03-10T14:17:35.239Z"}, "containers": {"cna": {"title": "facileManager Affected by Stored Cross-Site Scripting (XSS)", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/facileManager/facileManager/security/advisories/GHSA-2339-h9qw-q6vf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/facileManager/facileManager/security/advisories/GHSA-2339-h9qw-q6vf"}], "affected": [{"vendor": "facileManager", "product": "facileManager", "versions": [{"version": "5.4.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-09T22:54:49.645Z"}, "descriptions": [{"lang": "en", "value": "facileManager is a modular suite of web apps built with the sysadmin in mind. Prior to 6.0.4 , stored XSS (also known as persistent or second-order XSS) occurs when an application receives data from an untrusted source and includes that data in its subsequent HTTP responses in an unsafe manner. This vulnerability was found in the fmDNS module. This vulnerability is fixed in 6.0.4."}], "source": {"advisory": "GHSA-2339-h9qw-q6vf", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T14:17:07.783797Z", "id": "CVE-2026-30919", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T14:17:35.239Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30919", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-07T16:40:05.884Z", "datePublished": "2026-03-09T22:54:49.645Z", "dateUpdated": "2026-03-10T14:17:35.239Z"}, "containers": {"cna": {"title": "facileManager Affected by Stored Cross-Site Scripting (XSS)", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/facileManager/facileManager/security/advisories/GHSA-2339-h9qw-q6vf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/facileManager/facileManager/security/advisories/GHSA-2339-h9qw-q6vf"}], "affected": [{"vendor": "facileManager", "product": "facileManager", "versions": [{"version": "5.4.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-09T22:54:49.645Z"}, "descriptions": [{"lang": "en", "value": "facileManager is a modular suite of web apps built with the sysadmin in mind. Prior to 6.0.4 , stored XSS (also known as persistent or second-order XSS) occurs when an application receives data from an untrusted source and includes that data in its subsequent HTTP responses in an unsafe manner. This vulnerability was found in the fmDNS module. This vulnerability is fixed in 6.0.4."}], "source": {"advisory": "GHSA-2339-h9qw-q6vf", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30919", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-10T14:17:07.783797Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T14:17:31.124Z"}}]}}

{"affected": [{"affectedData": [{"product": "facileManager", "vendor": "facileManager", "versions": [{"status": "affected", "version": "5.4.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:facilemanager:facilemanager:*:*:*:*:*:*:*:*", "matchCriteriaId": "ACF32B72-7187-4B8C-B452-67ACBA089B76", "versionEndExcluding": "6.0.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "facileManager is a modular suite of web apps built with the sysadmin in mind. Prior to 6.0.4 , stored XSS (also known as persistent or second-order XSS) occurs when an application receives data from an untrusted source and includes that data in its subsequent HTTP responses in an unsafe manner. This vulnerability was found in the fmDNS module. This vulnerability is fixed in 6.0.4."}, {"lang": "es", "value": "facileManager es una suite modular de aplicaciones web construida pensando en el administrador de sistemas. Antes de 6.0.4, el XSS almacenado (tambi\u00e9n conocido como XSS persistente o de segundo orden) ocurre cuando una aplicaci\u00f3n recibe datos de una fuente no confiable e incluye esos datos en sus respuestas HTTP subsiguientes de manera insegura. Esta vulnerabilidad fue encontrada en el m\u00f3dulo fmDNS. Esta vulnerabilidad est\u00e1 corregida en 6.0.4."}], "id": "CVE-2026-30919", "lastModified": "2026-06-17T10:33:08.987", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30919", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T14:17:07.783797Z", "version": "2.0.3"}}]}, "published": "2026-03-10T17:40:15.837", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/facileManager/facileManager/security/advisories/GHSA-2339-h9qw-q6vf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.4.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "facileManager", "source": "cna", "vendor": "facileManager"}, "product": "facilemanager", "vendor": "facilemanager"}], "analysis": {"en": {"generated_at": "2026-04-16T10:01:28.484421+00:00", "value": {"mitigation_remediation": ["Upgrade facileManager to version 6.0.4 or newer to eliminate the stored XSS flaw", "Configure the application to perform strict input validation and output encoding for all user\u2011supplied data before rendering it in any page", "Limit user privileges for modules that accept external input and monitor for anomalous cross\u2011site scripting attempts"], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting (XSS) that allows an attacker to inject malicious script into HTTP responses shown to other authenticated users via the fmDNS module."}, "threat_synthesis": {"affected_systems": "The susceptible component is the fmDNS module of the facileManager suite. All installations of facileManager prior to version 6.0.4 are affected; the issue is resolved in 6.0.4 and later releases.", "description_and_impact": "The vulnerability is a stored XSS flaw where untrusted input is reflected in HTTP responses without sanitization. An attacker could inject JavaScript that executes in the context of other users\u2019 browsers, potentially enabling session hijacking, data theft, or defacement of the web interface. The weakness is a classic client\u2011side injection (CWE\u201179).", "risk_and_exploitability": "With a CVSS score of 7.6 the vulnerability is classified as high severity. The EPSS score is below 1%, indicating low predicted exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker inserting a malicious payload into a field accepted by the fmDNS module, which is then persisted and later rendered in another user\u2019s browser. No specific prerequisites beyond authenticated access to the module are stated, so the risk profile is medium\u2011to\u2011high if user accounts have privileged permissions."}}}}, "created": "2026-03-10T14:06:25.354447+00:00", "updated": "2026-04-16T10:15:26.100466+00:00", "vendors": ["facilemanager", "facilemanager$PRODUCT$facilemanager"]}