Description
A vulnerability was detected in stilleshan ServerStatus 1.0/2.0. Impacted is an unknown function of the file server/src/main.cpp of the component Stats Generation. Performing a manipulation of the argument custom results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-13
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in the Stats Generation component of stilleshan ServerStatus 1.0 and 2.0 allows an attacker to inject malicious code by manipulating the "custom" argument in server/src/main.cpp. The input is reflected without proper sanitisation, producing a reflected cross‑site scripting flaw that can be triggered remotely. An adversary delivering a crafted request can cause victim browsers to execute arbitrary JavaScript, potentially hijacking sessions or exfiltrating data.

Affected Systems

stilleshan ServerStatus version 1.0 and 2.0 are affected. The flaw resides solely in the Stats Generation module of these releases; no other versions or components are currently known to be impacted.

Risk and Exploitability

The vulnerability has a CVSS base score of 5.1, signalling moderate severity. EPSS is < 1%, indicating a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can target any exposed instance that accepts the "custom" parameter, and may remotely inject scripts that execute in the context of end‑user browsers.

Generated by OpenCVE AI on September 15, 2026 at 17:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply an updated version of stilleshan ServerStatus that flaw, if one is available.
  • Disable or tightly restrict the "custom" argument in the Stats Generation module so that no untrusted data can be passed to the view layer.
  • Configure output encoding for dynamic content and implement a strict Content Security Policy to block the execution of reflected scripts.

Generated by OpenCVE AI on September 15, 2026 at 17:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 13 Sep 2026 08:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in stilleshan ServerStatus 1.0/2.0. Impacted is an unknown function of the file server/src/main.cpp of the component Stats Generation. Performing a manipulation of the argument custom results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title stilleshan ServerStatus Stats Generation main.cpp cross site scripting
First Time appeared Stilleshan
Stilleshan serverstatus
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:stilleshan:serverstatus:*:*:*:*:*:*:*:*
Vendors & Products Stilleshan
Stilleshan serverstatus
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Stilleshan Serverstatus
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-14T15:37:30.331Z

Reserved: 2026-09-12T08:35:32.433Z

Link: CVE-2026-90502

cve-icon Vulnrichment

Updated: 2026-09-14T15:37:26.797Z

cve-icon NVD

Status : Deferred

Published: 2026-09-13T09:16:30.827

Modified: 2026-09-14T20:56:48.220

Link: CVE-2026-90502

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T17:30:10Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')