CVE-2026-15321

MyEMS Admin Backend svg.py on_post cross site scripting

View on CVE.org
Published Jul 10, 2026 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was found in MyEMS up to 6.4.0. The affected element is the function on_post of the file myems-api/core/svg.py of the component Admin Backend. The manipulation of the argument new_values['data'] results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used. Upgrading to version 6.5.0 is sufficient to fix this issue. The patch is identified as 4a97edfbd786c779d0322054833b21ddf54d5b06. It is suggested to upgrade the affected component. The issue report remains open even though there is an official fix for it.

Analysis

AI-generated

Technical impact

A flaw in the MyEMS Admin Backend SVG endpoint enables malicious data to be stored in the 'data' field for SVG files. This issue, located in the on_post function of myems-api/core/svg.py, arises from improper validation of new_values['data']—an example of CWE‑79 (Cross‑Site Scripting). The vulnerability permits remote attackers to inject arbitrary script that runs in the browser context of any user who views the compromised SVG.

Affected Systems

All installations of MyEMS running versions up to and including 6.4.0 are susceptible. The issue was fixed in the 6.5.0 release, which replaces the vulnerable handling with properly sanitized input processing. No other vendors or products are listed as affected.

Risk and Exploitability

The CVSS score of 4.8 indicates a moderate risk. The EPSS score of < 1% indicates that exploitation is currently unlikely, but the vulnerability can be triggered over the network by submitting crafted POST data to the vulnerable endpoint. Because the vulnerability can be triggered remotely, it poses a threat to any publicly accessible MyEMS administration interface that has not been patched.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the MyEMS installation to version 6.5.0 or later, which removes the vulnerable code path and implements proper input sanitization.
  • If an upgrade cannot be performed immediately, enforce strict server‑side validation and sanitization of the data field to strip or escape any JavaScript before storage.
  • Apply network or application‑layer filtering to block suspicious SVG POST requests from untrusted sources and consider restricting access to the admin interface.

Generated by OpenCVE AI on August 3, 2026 at 04:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was found in MyEMS up to 6.4.0. The affected element is the function on_post of the file myems-api/core/svg.py of the component Admin Backend. The manipulation of the argument new_values['data'] results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used. Upgrading to version 6.5.0 is sufficient to fix this issue. The patch is identified as 4a97edfbd786c779d0322054833b21ddf54d5b06. It is suggested to upgrade the affected component. The issue report remains open even though there is an official fix for it.
Title MyEMS Admin Backend svg.py on_post cross site scripting
First Time appeared Myems
Myems myems
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:myems:myems:*:*:*:*:*:*:*:*
Vendors & Products Myems
Myems myems
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 10, 2026, 6:25 PM
Reserved
Jul 9, 2026, 6:12 PM

View source JSON

Updated
Jul 10, 2026, 6:25 PM

JSON

Status
Deferred
Published
Jul 10, 2026, 4:17 AM
Modified
Jul 10, 2026, 7:17 PM

View source JSON

No data.

Updated
Aug 3, 2026, 4:30 AM

JSON