Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attackers to execute arbitrary JavaScript by crafting malicious STL template payloads that are decrypted and returned without proper sanitization. Attackers can exploit improper output encoding in the /api/stl/actions/dynamic endpoint to inject executable JavaScript into JSON responses, leading to session hijacking, phishing attacks, and unauthorized actions performed on behalf of users.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-7429 SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attackers to execute arbitrary JavaScript by crafting ma… https://www.cve.org/CVERecord?id=CVE-2026-7429
Post summary
The statement announces a reflected XSS flaw (CVE-2026-7429) in SSCMS v7.4.0 that permits arbitrary JavaScript execution via crafted requests.
🚨*CVE* CVE-2026-7429 SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attackers to execute arbitrary JavaScript by crafting ma… https://www.cve.org/CVERecord?id=CVE-2026-7429 ----- Traducción: CVE-2026-7429 SSC… http://infoflow.cloud`
Post summary
The tweet discloses a reflected XSS vulnerability (CVE‑2026‑7429) in SSCMS v7.4.0 that permits execution of arbitrary JavaScript, but it provides no PoC, exploit code, or patch information.