Medium severity4.6NVD Advisory· Published Apr 30, 2026· Updated May 1, 2026

CVE-2026-7429

Description

SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attackers to execute arbitrary JavaScript by crafting malicious STL template payloads that are decrypted and returned without proper sanitization. Attackers can exploit improper output encoding in the /api/stl/actions/dynamic endpoint to inject executable JavaScript into JSON responses, leading to session hijacking, phishing attacks, and unauthorized actions performed on behalf of users.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Siteserver/CMSreferences
Sheer Vision Technologies/Sscmsllm-fuzzy
Range: =7.4.0

Patches

Vulnerability mechanics

References

News mentions

No linked articles in our index yet.

Severity

MediumCVSS v3.1

4.6/ 10

CVSS v42.1

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: Required
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: None

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Affected

Source repo: github.com/siteserver/cms

EPSS

Probability of exploitation in the next 30 days.

0.17%

VYPR risk score

Composite of severity, exploitation, and reach.

0.30low

cvss	0.299
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE ID

CVE-2026-7429

Credits

BF
Beatriz Fresno Naumova
other
H(
hss94531 (https://github.com/hss94531)
other