Cachet has Stored XSS in Incident Component
影響: composer:cachethq/cachet <= 2.4.1
A stored Cross-Site Scripting (XSS) vulnerability exists in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover. Details The incident Name and Message fields do not properly sanitize HTML event handler attributes. While tags appear to be filtered, event-based payloads are not blocked. Affected endpoint: /dashbo…
| CVE | CVE-2026-113712 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 22. 오전 01:17 |
| 데이터 | Markdown JSON |
2026. 10. 21. 오전 06:09, GitHub Advisory Database에서 "Cachet has Stored XSS in Incident Component"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: PHP. CVE: CVE-2026-113712.