Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Pachno 1.0.6 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads into POST parameters. Attackers can inject scripts through the value, comment_body, article_content, description, and message parameters across multiple controllers, which are stored in the database and executed in users' browser sessions due to improper sanitization via Request::getRawParameter() or Request::getParameter() calls.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🚨*CVE* CVE-2026-40038 Pachno 1.0.6 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads into… https://www.cve.org/CVERecord?id=CVE-2026-40038 ----- Traducción: CVE-2026-40038 Pac… http://infoflow.cloud`
Post summary
CVE-2026-40038 exposes a stored XSS flaw in Pachno 1.0.6, enabling arbitrary HTML and script execution.
CVE-2026-40038 Pachno 1.0.6 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads into… https://www.cve.org/CVERecord?id=CVE-2026-40038
Post summary
The post announces that Pachno 1.0.6 has a stored XSS flaw (CVE‑2026‑40038) enabling malicious HTML and script execution, but provides no PoC, exploit code, patch info or evidence of active exploitation.