CVE-2026-13558

🗓️ 29 Jun 2026 10:15:06Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 16 Views🌐 WEB

CVE-2026-13558 in CodeAstro Complaint Management System 1.0 enables cross site scripting via /report/addreport.

Reporter	Title	Published	Views	Family All 7
ATTACKERKB	CVE-2026-13558	29 Jun 202610:15	–	attackerkb
Circl	CVE-2026-13558	30 Jun 202611:39	–	circl
Cvelist	CVE-2026-13558 CodeAstro Complaint Management System Report addreport cross site scripting	29 Jun 202610:15	–	cvelist
EUVD	EUVD-2026-40067	29 Jun 202610:15	–	euvd
NVD	CVE-2026-13558	29 Jun 202612:16	–	nvd
Positive Technologies	PT-2026-53249	29 Jun 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-13558 CodeAstro Complaint Management System Report addreport cross site scripting	29 Jun 202610:15	–	vulnrichment

Vulners

Node

codeastro complaint_management_systemMatch1.0

[
  {
    "vendor": "CodeAstro",
    "product": "Complaint Management System",
    "versions": [
      {
        "version": "1.0",
        "status": "affected"
      }
    ],
    "cpes": [
      "cpe:2.3:a:codeastro:complaint_management_system:*:*:*:*:*:*:*:*"
    ],
    "modules": [
      "Report Handler"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/vuln/374566
github	www.github.com/ashikmd0507/CVE/blob/main/Stored%20XSS%20in%20Report%20Title%20Field%20Allows%20Script%20Execution%20in%20Admin%20Panel/README.md
vuldb	www.vuldb.com/cve/CVE-2026-13558
vuldb	www.vuldb.com/submit/843714
vuldb	www.vuldb.com/vuln/374566/cti
codeastro	www.codeastro.com/

Parameter	Position	Path	Description	CWE
Report Title	request body	/report/addreport	Cross-site scripting via manipulation of the Report Title parameter in the addreport endpoint.	CWE-79, CWE-94

29 Jun 2026 18:46Current

4.5Medium risk

Vulners AI Score4.5

CVSS 3.13.5

CVSS 24

CVSS 45.1

CVSS 33.5

EPSS0.00328

SSVC