Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Cross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-08 | 2 | Disclosure2 |
| 2026-04-13 | 1 | Disclosure1 |
CVE-2026-27787 Cross-site scripting vulnerability exists in MATCHA SNS 1.3.9 and earlier. If this vulnerability is exploited, an arbitrary script may be executed on the web browser … https://www.cve.org/CVERecord?id=CVE-2026-27787
Post summary
The excerpt simply discloses a cross‑site scripting flaw in MATCHA SNS 1.3.9 and earlier, highlighting potential arbitrary script execution in affected browsers.
CVE-2026-27787 Cross-Site Scripting Vulnerability in MATCHA SNS 1.3.9 and Earlier https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27787
Post summary
The brief note announces a cross‑site scripting vulnerability (CVE‑2026‑27787) in MATCHA SNS 1.3.9 and earlier, providing minimal technical detail but no evidence of exploitation or remediation.
⚠️ **Vulnerability Alert:** Multiple vulnerabilities in 抹茶シリーズ (SQL Injection, XSS, Insecure File Upload) 📅 **Timeline:** Disclosure: Not Available, Patch: Not Available 🆔 **CVE-2026-24913** | 📊 CVSS: 8.8 (High 🟠) | 📈 EPSS: Not Available% 🆔 **CVE-2026-27787** | 📊 CVSS: 8.8 (High 🟠) | 📈 EPSS: Not Available% 🆔 **CVE-2026-33273** | 📊 CVSS: 8.8 (High 🟠) | 📈 EPSS: Not Available% 🛠️ **Exploit Maturity:** Not Available 📂 **Affected Versions:** 抹茶請求書 2.6.6 およびそれ以前, 抹茶SNS 1.3.9 およびそれ以前 🫨 **Attack Vectors:** - SQL Injection (authenticated) - Stored Cross-Site Scripting (XSS) - Insecure file upload allowing arbitrary file creation leading to potential code execution 📝 **Summary:** Multiple high-severity vulnerabilities in the 抹茶シリーズ allow authenticated SQL injection, stored XSS, and insecure file uploads that can lead to database compromise, session theft/phishing, and server-side arbitrary file creation with potential RCE. No vendor patches are available yet, so immediate mitigation, monitoring, and preparation for patch deployment are required. 📈 **Impact Scope:** Potential unauthorized database access/modification, script execution in site visitors' browsers (session/cookie theft, phishing), and arbitrary file creation on server possibly leading to remote code execution and full server compromise. 🛡️ **Recommended Actions:** - Apply vendor-supplied fixes/updates as soon as available - Harden authentication and enforce least privilege for admin accounts - Validate/sanitize inputs and use parameterized queries; encode outputs to mitigate XSS - Enforce strict file upload validation, scan content, and store uploads outside the web root - Deploy or tune WAF rules and increase log monitoring for IOCs - Rotate credentials and ensure recent backups & an incident response plan 🪢 **Related Resources:** - https://jvn.jp/jp/JVN33581068/ - https://jvndb.jvn.jp/jvndb/JVNDB-2026-000052 🏷 **Tags:** #Cybersecurity #WebApp #SQLi_XSS
Post summary
The post announces high‑severity CVEs affecting the 抹茶シリーズ, detailing the attack vectors, affected versions, and recommended mitigation actions, but does not provide proof of exploitation or a functioning exploit.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | icz | matcha_sns | - | - | - |