Description
Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browsers.
Published: 2026-03-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting execution in victims’ browsers
Action: Patch
AI Analysis

Impact

Vulnogram 1.0.0 holds a stored cross‑site scripting flaw in the way comment hypertext is processed. Attackers can inject malicious script code into comments, which is then executed by any browser that renders the comment.

Affected Systems

All installations of Vulnogram version 1.0.0, including the beta1 build, that expose public comment posting are vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate impact, while the EPSS of less than 1 % reflects a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can reach the flaw through the normal comment submission interface; the compromise occurs only within the victim’s browser and does not affect the server itself.

Generated by OpenCVE AI on March 20, 2026 at 19:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest Vulnogram release that includes the XSS fix
  • If an upgrade is not yet possible, add server‑side input sanitization for comment data
  • As a temporary measure, disable the comment functionality until a patch is applied
  • Regularly review comment sections for suspicious entries

Generated by OpenCVE AI on March 20, 2026 at 19:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-vggc-6pg2-xvp9 Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handling
History

Fri, 20 Mar 2026 18:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:vulnogram:vulnogram:1.0.0:beta1:*:*:*:*:*:*

Thu, 19 Mar 2026 18:30:00 +0000

Type Values Removed Values Added
References

Tue, 17 Mar 2026 20:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:vulnogram:vulnogram:1.0.0:*:*:*:*:*:*:*
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

 cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Mon, 16 Mar 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 16 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Vulnogram
Vulnogram vulnogram
Vendors & Products Vulnogram
Vulnogram vulnogram

Sat, 14 Mar 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browsers.
Title Vulnogram - Stored Cross-Site Scripting via Comment Hypertext
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

Vulnogram Vulnogram
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-03-19T17:49:50.974Z

Reserved: 2026-03-14T21:26:03.800Z

Link: CVE-2026-32774

cve-icon Vulnrichment

Updated: 2026-03-19T17:49:50.974Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-16T14:19:44.207

Modified: 2026-03-20T18:26:35.590

Link: CVE-2026-32774

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-23T13:39:05Z

Weaknesses