CVE-2026-7501

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7501", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-30T14:38:39.545Z", "datePublished": "2026-04-30T20:45:12.021Z", "dateUpdated": "2026-05-01T19:30:37.795Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-30T20:45:12.021Z"}, "title": "LinkStackOrg LinkStack UserController.php editPage cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "Cross Site Scripting"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "LinkStackOrg", "product": "LinkStack", "versions": [{"version": "4.8.0", "status": "affected"}, {"version": "4.8.1", "status": "affected"}, {"version": "4.8.2", "status": "affected"}, {"version": "4.8.3", "status": "affected"}, {"version": "4.8.4", "status": "affected"}, {"version": "4.8.5", "status": "affected"}, {"version": "4.8.6", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in LinkStackOrg LinkStack up to 4.8.6. Impacted is the function editPage of the file app/Http/Controllers/UserController.php. Executing a manipulation of the argument pageDescription can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a pull request but has not reacted yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-30T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-30T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-30T16:43:55.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "AliAz (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/360311", "name": "VDB-360311 | LinkStackOrg LinkStack UserController.php editPage cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/360311/cti", "name": "VDB-360311 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/801651", "name": "Submit #801651 | LinkStackOrg LinkStack 4.8.6 Improper Neutralization of Alternate XSS Syntax", "tags": ["third-party-advisory"]}, {"url": "https://github.com/LinkStackOrg/LinkStack/pull/974", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/az10b/security-advisories/blob/main/stored_xss_linkstack.md", "tags": ["exploit"]}, {"url": "https://github.com/LinkStackOrg/LinkStack/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-01T16:19:23.764878Z", "id": "CVE-2026-7501", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-01T19:30:37.795Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7501", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-01T16:19:23.764878Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-01T16:19:29.173Z"}}], "cna": {"title": "LinkStackOrg LinkStack UserController.php editPage cross site scripting", "credits": [{"lang": "en", "type": "reporter", "value": "AliAz (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "LinkStackOrg", "product": "LinkStack", "versions": [{"status": "affected", "version": "4.8.0"}, {"status": "affected", "version": "4.8.1"}, {"status": "affected", "version": "4.8.2"}, {"status": "affected", "version": "4.8.3"}, {"status": "affected", "version": "4.8.4"}, {"status": "affected", "version": "4.8.5"}, {"status": "affected", "version": "4.8.6"}]}], "timeline": [{"lang": "en", "time": "2026-04-30T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-30T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-30T16:43:55.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/360311", "name": "VDB-360311 | LinkStackOrg LinkStack UserController.php editPage cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/360311/cti", "name": "VDB-360311 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/801651", "name": "Submit #801651 | LinkStackOrg LinkStack 4.8.6 Improper Neutralization of Alternate XSS Syntax", "tags": ["third-party-advisory"]}, {"url": "https://github.com/LinkStackOrg/LinkStack/pull/974", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/az10b/security-advisories/blob/main/stored_xss_linkstack.md", "tags": ["exploit"]}, {"url": "https://github.com/LinkStackOrg/LinkStack/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in LinkStackOrg LinkStack up to 4.8.6. Impacted is the function editPage of the file app/Http/Controllers/UserController.php. Executing a manipulation of the argument pageDescription can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a pull request but has not reacted yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross Site Scripting"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-30T20:45:12.021Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7501", "state": "PUBLISHED", "dateUpdated": "2026-05-01T19:30:37.795Z", "dateReserved": "2026-04-30T14:38:39.545Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-30T20:45:12.021Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "LinkStack", "vendor": "LinkStackOrg", "versions": [{"status": "affected", "version": "4.8.0"}, {"status": "affected", "version": "4.8.1"}, {"status": "affected", "version": "4.8.2"}, {"status": "affected", "version": "4.8.3"}, {"status": "affected", "version": "4.8.4"}, {"status": "affected", "version": "4.8.5"}, {"status": "affected", "version": "4.8.6"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in LinkStackOrg LinkStack up to 4.8.6. Impacted is the function editPage of the file app/Http/Controllers/UserController.php. Executing a manipulation of the argument pageDescription can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a pull request but has not reacted yet."}, {"lang": "es", "value": "Se ha identificado una debilidad en LinkStackOrg LinkStack hasta la versi\u00f3n 4.8.6. La funci\u00f3n editPage del archivo app/HTTP/Controllers/UserController.PHP se ve afectada. La ejecuci\u00f3n de una manipulaci\u00f3n del argumento pageDescription puede conducir a cross site scripting. Es posible lanzar el ataque de forma remota. El exploit ha sido puesto a disposici\u00f3n del p\u00fablico y podr\u00eda ser utilizado para ataques. El proyecto fue informado del problema con antelaci\u00f3n a trav\u00e9s de una pull request pero a\u00fan no ha reaccionado."}], "id": "CVE-2026-7501", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7501", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-01T16:19:23.764878Z", "version": "2.0.3"}}]}, "published": "2026-04-30T21:16:34.360", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/LinkStackOrg/LinkStack/"}, {"source": "cna@vuldb.com", "url": "https://github.com/LinkStackOrg/LinkStack/pull/974"}, {"source": "cna@vuldb.com", "url": "https://github.com/az10b/security-advisories/blob/main/stored_xss_linkstack.md"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/801651"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/360311"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/360311/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.8.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.8.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.8.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.8.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.8.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.8.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.8.6"}}], "enrichment": {"confidence": 93.0, "confidence_source": "matching", "scores": [{"score": 93.0, "source": "matching"}]}, "original": {"product": "LinkStack", "source": "cna", "vendor": "LinkStackOrg"}, "product": "linkstack", "vendor": "linkstack"}], "created": "2026-05-01T05:00:12.283054+00:00", "updated": "2026-05-01T08:15:12.455287+00:00", "vendors": ["linkstack", "linkstack$PRODUCT$linkstack"]}