CVE-2026-5254mediumCWE-79CWE-94

CVE-2026-5254: medium-severity vulnerability in welovemedia FFmate

welovemedia FFmate Webhook AppJsonTreeView.vue cross site scripting

Published

Follow this CVE+ Monitor FFmate

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.1epss 0.2%
A security vulnerability has been detected in welovemedia FFmate up to 2.0.15. Affected by this issue is some unknown functionality of the file /ui/app/components/AppJsonTreeView.vue of the component Webhook Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
welovemedia · FFmate
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — welovemedia FFmate

In the same product, most dangerous first.

CVE-2026-3682MEDIUMwelovemedia FFmate ffmpeg.go Execute argument injectionEPSS 0.3%CVE-2026-3681MEDIUMwelovemedia FFmate webhook.go fireWebhook server-side request forgeryEPSS 0.3%