CVE-2026-120443: medium-severity vulnerability in sea-team GoFound
GoFound through 1.4.1 Stored XSS via Admin Dashboard Search Results
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.1epss 0.3%
GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dashboard.vue renders with v-html, executing script in an administrator's browser when an admin search matches the document.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
sea-team · GoFoundpublic PoCs found — 1
cve_referencevul.yulun.ac.cn/20261102/gofound/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — sea-team GoFound
In the same product, most dangerous first.
References
https://github.com/sea-team/gofound/blob/v1.4.1/searcher/engine.gohttps://github.com/sea-team/gofound/blob/v1.4.1/web/admin/assets/web/src/views/dashboard.vuehttps://github.com/sea-team/gofound/issues/101https://vul.yulun.ac.cn/20261102/gofound/https://www.vulncheck.com/advisories/gofound-through-1.4.1-stored-xss-via-admin-dashboard-search-results