CVE-2026-13558 Details
Description
A security flaw has been discovered in CodeAstro Complaint Management System 1.0. This issue affects some unknown processing of the file /report/addreport of the component Report Handler. Performing a manipulation of the argument Report Title results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
A stored cross-site scripting vulnerability has been identified in CodeAstro Complaint Management System version 1.0. The issue arises in the Report Handler component, specifically within the '/report/addreport' endpoint. The vulnerability allows low-privileged users to inject malicious JavaScript into the 'Report Title' field, which is then executed when an administrator views the report management page. This exploitation could lead to session hijacking, unauthorized actions, privilege escalation, and a complete takeover of the administrative account.
User input should be properly sanitized and encoded before being displayed in HTML. Implement server-side input validation and context-aware output encoding for all user-controlled fields. Consider applying a Content Security Policy to mitigate the risk of script execution. Regular security testing should be conducted to identify and address similar vulnerabilities.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 29, 2026CISA-ADP
Assessed Jun 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://codeastro.com/ | [email protected] | Vendor |
| https://github.com/ashikmd0507/CVE/blob/main/Stored%20XSS%20in%20Report%20Title%20Field%20Allows%20Script%20Execution%20in%20Admin%20Panel/README.md | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-13558 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/843714 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/374566 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/374566/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CodeAstro Complaint Management System | v1.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | CVE Modified | CISA-ADP |
| Jun 29, 2026 | New CVE Received | [email protected] |