CVE-2026-5253

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5253", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-31T16:13:21.226Z", "datePublished": "2026-04-01T03:15:16.089Z", "dateUpdated": "2026-04-01T19:05:29.371Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-01T03:15:16.089Z"}, "title": "bufanyun HotGo editNotice Endpoint MessageList.vue cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "Cross Site Scripting"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "bufanyun", "product": "HotGo", "versions": [{"version": "1.0", "status": "affected"}, {"version": "2.0", "status": "affected"}], "modules": ["editNotice Endpoint"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in bufanyun HotGo 1.0/2.0. Affected by this vulnerability is an unknown functionality of the file /web/src/layout/components/Header/MessageList.vue of the component editNotice Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-31T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-31T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-31T18:18:26.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "VulDB", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/354443", "name": "VDB-354443 | bufanyun HotGo editNotice Endpoint MessageList.vue cross site scripting", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/354443/cti", "name": "VDB-354443 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/780614", "name": "Submit #780614 | bufanyun HotGo <= v2.0 Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://github.com/CC-T-454455/Vulnerabilities/tree/master/hotgo/vulnerability-2", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T19:05:21.578944Z", "id": "CVE-2026-5253", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T19:05:29.371Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5253", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T19:05:21.578944Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T19:05:25.211Z"}}], "cna": {"title": "bufanyun HotGo editNotice Endpoint MessageList.vue cross site scripting", "credits": [{"lang": "en", "type": "coordinator", "value": "VulDB"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "bufanyun", "modules": ["editNotice Endpoint"], "product": "HotGo", "versions": [{"status": "affected", "version": "1.0"}, {"status": "affected", "version": "2.0"}]}], "timeline": [{"lang": "en", "time": "2026-03-31T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-31T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-31T18:18:26.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/354443", "name": "VDB-354443 | bufanyun HotGo editNotice Endpoint MessageList.vue cross site scripting", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/vuln/354443/cti", "name": "VDB-354443 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/780614", "name": "Submit #780614 | bufanyun HotGo <= v2.0 Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://github.com/CC-T-454455/Vulnerabilities/tree/master/hotgo/vulnerability-2", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in bufanyun HotGo 1.0/2.0. Affected by this vulnerability is an unknown functionality of the file /web/src/layout/components/Header/MessageList.vue of the component editNotice Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross Site Scripting"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-01T03:15:16.089Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5253", "state": "PUBLISHED", "dateUpdated": "2026-04-01T19:05:29.371Z", "dateReserved": "2026-03-31T16:13:21.226Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-01T03:15:16.089Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["editNotice Endpoint"], "product": "HotGo", "vendor": "bufanyun", "versions": [{"status": "affected", "version": "1.0"}, {"status": "affected", "version": "2.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in bufanyun HotGo 1.0/2.0. Affected by this vulnerability is an unknown functionality of the file /web/src/layout/components/Header/MessageList.vue of the component editNotice Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha identificado una debilidad en bufanyun HotGo 1.0/2.0. Afectada por esta vulnerabilidad es una funcionalidad desconocida del archivo /web/src/layout/components/Header/MessageList.vue del componente editNotice Endpoint. La ejecuci\u00f3n de una manipulaci\u00f3n puede llevar a cross site scripting. El ataque puede ser lanzado remotamente. El exploit ha sido puesto a disposici\u00f3n del p\u00fablico y podr\u00eda ser utilizado para ataques. El proveedor fue contactado tempranamente sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-5253", "lastModified": "2026-06-17T10:58:41.170", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5253", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T19:05:21.578944Z", "version": "2.0.3"}}]}, "published": "2026-04-01T04:17:12.690", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/CC-T-454455/Vulnerabilities/tree/master/hotgo/vulnerability-2"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/780614"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/354443"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/354443/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "HotGo", "source": "cna", "vendor": "bufanyun"}, "product": "hotgo", "vendor": "bufanyun"}], "analysis": {"en": {"generated_at": "2026-04-01T05:20:18.077808+00:00", "value": {"mitigation_remediation": ["Apply the patch supplied in the publicly available vulnerability repository (https://github.com/CC-T-454455/Vulnerabilities).", "If patch cannot be applied, disable or remove the editNotice endpoint from the HotGo instance to block the vulnerable component.", "Ensure input values rendered in MessageList.vue are properly escaped or sanitized to prevent script injection.", "Update HotGo to a later major release if available, or apply any vendor\u2011issued fixes once released.", "Monitor application logs and user activity for signs of XSS exploitation."], "summary": {"action": "Apply Patch", "impact": "Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "HotGo, open\u2011source project from bufanyun, was affected in its 1.0 and 2.0 releases. Any deployment that uses the editNotice feature and serves the MessageList.vue component remains vulnerable. Users should confirm their HotGo installation version and whether the component is active.", "description_and_impact": "The vulnerability resides in HotGo 1.0/2.0 within MessageList.vue of the editNotice endpoint. By manipulating input to that component, an attacker can inject arbitrary JavaScript that executes in the context of victim browsers. This cross\u2011site scripting can lead to credential theft, session hijacking, or defacement. The flaw is a classic unsanitized input error, classified as CWE\u201179.", "risk_and_exploitability": "The CVSS base score of 5.1 indicates medium severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, but a publicly available exploit demonstrates that attackers can launch the attack remotely. Because the flaw arises from client\u2011side template rendering, it can be exploited by simply visiting a crafted URL, putting the risk within the attack surface for any authenticated or unauthenticated user who can reach the editNotice endpoint."}}}}, "created": "2026-04-02T07:50:17.591749+00:00", "updated": "2026-04-02T20:18:29.692726+00:00", "vendors": ["bufanyun", "bufanyun$PRODUCT$hotgo"]}