Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-8080 Details

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in misp allows Stored XSS. This issue affects MISP before 2.5.37. A stored cross-site scripting vulnerability exists in the template element attribute handling logic. The application accepted arbitrary values for the TemplateElementAttribute type and category fields without validating them against the known MISP attribute type and category definitions. An attacker with permission to create or modify template element attributes could store a crafted type value. This affects the old templating (not more accessible in 2.5.37) engine from MISP which will be removed in 2.5.38

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:5.4 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/MISP/MISP/commit/62824e5ca0056d01b195f70466ea0d382cca06d0	CIRCL	Patch

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	CIRCL

Affected Products

Product	Versions
misp-project misp	< 2.5.37
CPE cpe:2.3:a:misp-project:misp:::::::: Remediation No remediation found in references.

Change History

5 change records found show changes

Date	Action	Recorded By
Jun 22, 2026	CPE Deprecation Remap	[email protected]
Jun 17, 2026	CVE Modified	CIRCL
Jun 17, 2026	CVE Modified	CISA-ADP
May 11, 2026	Initial Analysis	[email protected]
May 7, 2026	New CVE Received	CIRCL