CVE-2026-58475: medium-severity vulnerability in Dan-in-CA SIP
Sustainable Irrigation Platform 5.2.16 Stored XSS via Program Name
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.3%
Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by supplying malicious script payloads within program names submitted via HTTP requests. Attackers can exploit the lack of output encoding on rendered program names to execute arbitrary JavaScript in the browsers of any users viewing the affected page, with exploitation facilitated by the absence of a required passphrase or the default passphrase 'opendoor'.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
Dan-in-CA · SIPpublic PoCs found — 1
cve_referencewww.zeroscience.mk/#/advisories/ZSL-2026-5994unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Dan-in-CA SIP
In the same product, most dangerous first.
CVE-2026-58479CRITICALSustainable Irrigation Platform 5.2.16 RCE via cli_control Plugin Command InjectionEPSS 4.4%CVE-2026-58477HIGHSustainable Irrigation Platform 5.2.16 Mass Assignment via HTTP ParametersEPSS 0.5%CVE-2026-60114HIGHSustainable Irrigation Platform 5.2.16 Path Traversal via JSON Backup RestoreEPSS 0.5%CVE-2026-58478MEDIUMSustainable Irrigation Platform 5.2.16 SSRF via Node-RED Callback URLEPSS 0.4%CVE-2026-58476HIGHSustainable Irrigation Platform 5.2.16 CSRF via Administrative GET RequestsEPSS 0.3%