VulnSocial

CVE-2026-113712

LOWCVSS 4.8 · MEDIUM

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting (XSS) vulnerability in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover. Commits 57b44a8bac0b250b0d5751e93e0349070d14606e and 23adbb88ffa819f92be4a905ff1d812670d980a2 in `cachethq/core` patch the issue.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post
  • DailyCVE@dailycve

    🟠 Cachet, Stored Cross-Site Scripting, #CVE-2026-113712 (Moderate) -DC-Oct2026-3494 https://dailycve.com/cachet-stored-cross-site-scripting-cve-2026-113712-moderate-dc-oct2026-3494/

    0000022
    245 followersView on X

Explore more

Back to dashboard