CVE-2026-39425

🗓️ 14 Apr 2026 01:18:42Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 57 Views🌐 WEB

Stored XSS in MaxKB before 2.8.0 via unsanitized html_rander in prologue, enabling HTML/JS injection.

Reporter	Title	Published	Views	Family All 10
attackerkb	CVE-2026-39425	14 Apr 202601:18	–	attackerkb
Circl	CVE-2026-39425	14 Apr 202605:04	–	circl
CNNVD	MaxKB 安全漏洞	14 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-39425 MaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown Rendering	14 Apr 202601:18	–	cvelist
EUVD	EUVD-2026-22192	14 Apr 202601:18	–	euvd
NVD	CVE-2026-39425	14 Apr 202602:16	–	nvd
Positive Technologies	PT-2026-32584	14 Apr 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-39425: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)	14 Apr 202600:00	–	rapid7
RedhatCVE	CVE-2026-39425	5 Jun 202619:26	–	redhatcve
Vulnrichment	CVE-2026-39425 MaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown Rendering	14 Apr 202601:18	–	vulnrichment

NVD

Vulners

Node

maxkb maxkbRange<2.8.0-

[
  {
    "vendor": "1Panel-dev",
    "product": "MaxKB",
    "versions": [
      {
        "version": "< 2.8.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/1Panel-dev/MaxKB/security/advisories/GHSA-3rq5-pgm7-pvp4
github	www.github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0

Parameter	Position	Path	Description	CWE
prologue	request body	admin/api/workspace/{workspace_id}/application	Stored XSS via unsanitized prologue field on application creation/update; attacker can inject HTML/JS wrapped in <html_rander> tags, which is stored in the database and rendered to visitors, enabling persistent DOM-based XSS.	CWE-80

17 Jun 2026 10:42Current

6Medium risk

Vulners AI Score6

CVSS 3.15.4

CVSS 45.1

EPSS0.00283

SSVC

CWE-80