CVE-2026-6990

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6990", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-24T19:27:32.153Z", "datePublished": "2026-04-25T17:30:15.529Z", "dateUpdated": "2026-04-27T12:37:42.038Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-25T17:30:15.529Z"}, "title": "projeto-siga novo cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "Cross Site Scripting"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "projeto-siga", "product": "siga", "versions": [{"version": "11.0.3.18", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in projeto-siga siga 11.0.3.18. The affected element is an unknown function of the file /sigawf/app/responsavel/novo. Performing a manipulation of the argument Nome/Descri\u00e7\u00e3o results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-24T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-24T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-24T21:32:54.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "vini_castro (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/359542", "name": "VDB-359542 | projeto-siga novo cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359542/cti", "name": "VDB-359542 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/796647", "name": "Submit #796647 | Projeto SIGA SIGA WF 11.0.3.18 Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://github.com/projeto-siga/siga/issues/2491", "tags": ["issue-tracking"]}, {"url": "https://github.com/ViniCastro2001/Security_Reports/tree/main/siga/Stored-XSS-Responsavel", "tags": ["exploit"]}, {"url": "https://github.com/projeto-siga/siga/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T12:37:31.593067Z", "id": "CVE-2026-6990", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T12:37:42.038Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6990", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T12:37:31.593067Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T12:37:37.018Z"}}], "cna": {"title": "projeto-siga novo cross site scripting", "credits": [{"lang": "en", "type": "reporter", "value": "vini_castro (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "projeto-siga", "product": "siga", "versions": [{"status": "affected", "version": "11.0.3.18"}]}], "timeline": [{"lang": "en", "time": "2026-04-24T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-24T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-24T21:32:54.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/359542", "name": "VDB-359542 | projeto-siga novo cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359542/cti", "name": "VDB-359542 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/796647", "name": "Submit #796647 | Projeto SIGA SIGA WF 11.0.3.18 Cross Site Scripting", "tags": ["third-party-advisory"]}, {"url": "https://github.com/projeto-siga/siga/issues/2491", "tags": ["issue-tracking"]}, {"url": "https://github.com/ViniCastro2001/Security_Reports/tree/main/siga/Stored-XSS-Responsavel", "tags": ["exploit"]}, {"url": "https://github.com/projeto-siga/siga/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in projeto-siga siga 11.0.3.18. The affected element is an unknown function of the file /sigawf/app/responsavel/novo. Performing a manipulation of the argument Nome/Descri\u00e7\u00e3o results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross Site Scripting"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-25T17:30:15.529Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6990", "state": "PUBLISHED", "dateUpdated": "2026-04-27T12:37:42.038Z", "dateReserved": "2026-04-24T19:27:32.153Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-25T17:30:15.529Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "siga", "vendor": "projeto-siga", "versions": [{"status": "affected", "version": "11.0.3.18"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in projeto-siga siga 11.0.3.18. The affected element is an unknown function of the file /sigawf/app/responsavel/novo. Performing a manipulation of the argument Nome/Descri\u00e7\u00e3o results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en projeto-siga siga 11.0.3.18. El elemento afectado es una funci\u00f3n desconocida del archivo /sigawf/app/responsavel/novo. Realizar una manipulaci\u00f3n del argumento Nome/Descri\u00e7\u00e3o resulta en cross site scripting. El ataque puede iniciarse de forma remota. El exploit se ha hecho p\u00fablico y podr\u00eda usarse. El proyecto fue informado del problema con antelaci\u00f3n a trav\u00e9s de un informe de incidencias, pero a\u00fan no ha respondido."}], "id": "CVE-2026-6990", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6990", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-27T12:37:31.593067Z", "version": "2.0.3"}}]}, "published": "2026-04-25T18:16:19.077", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/ViniCastro2001/Security_Reports/tree/main/siga/Stored-XSS-Responsavel"}, {"source": "cna@vuldb.com", "url": "https://github.com/projeto-siga/siga/"}, {"source": "cna@vuldb.com", "url": "https://github.com/projeto-siga/siga/issues/2491"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/796647"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359542"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359542/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "11.0.3.18"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "siga", "source": "cna", "vendor": "projeto-siga"}, "product": "siga", "vendor": "projeto-siga"}], "analysis": {"en": {"generated_at": "2026-04-28T05:31:46.885638+00:00", "value": {"mitigation_remediation": ["Obtain and install the latest oficial release or hotfix from projeto\u2011siga that sanitizes the Nome/Descri\u00e7\u00e3o input.", "Implement server\u2011side validation that encodes or strips script tags and dangerous attributes before storing the field\u2019s value.", "Deploy a content\u2011security\u2011policy restricting script execution to mitigate the impact of any remaining XSS vectors."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The affected product is projeto\u2011siga Siga. The vulnerability has been identified specifically in version\u202f11.0.3.18 of the application.", "description_and_impact": "A stored cross\u2011site scripting flaw exists in projeto\u2011siga Siga version\u202f11.0.3.18. By submitting a malicious payload in the Nome/Descri\u00e7\u00e3o field of the /sigawf/app/responsavel/novo endpoint, an attacker can cause arbitrary script execution in the browser of any user who later views that stored content. This flaw leads to potential session hijacking, defacement, and data theft because the injected script runs with the privileges of the victim's browser session.", "risk_and_exploitability": "The CVSS score of\u202f5.1 indicates a moderate risk, while the EPSS score of less than\u202f1\u202f% reflects a relatively low likelihood of exploitation at this time. The flaw is exploitable remotely via the web interface and does not require privileged access; an attacker merely needs to submit a crafted Nome/Descri\u00e7\u00e3o value. The vulnerability is not listed in the CISA KEV catalog, but the public disclosure of an active exploit means that exploitation is feasible if the flaw remains unpatched."}}}}, "created": "2026-04-27T19:52:44.228546+00:00", "updated": "2026-04-28T05:45:23.288383+00:00", "vendors": ["projeto-siga", "projeto-siga$PRODUCT$siga"]}