CVE-2026-42157: falha de média gravidade em reconurge flowsint
Flowsint: Stored XSS on map node marker in map page
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.3%
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, a remote attacker can create a map node with a malicious label that contains arbitrary HTML. When the map tab is selected and a map node marker is selected, it will render the arbitrary HTML, potentially triggering stored XSS. This vulnerability is fixed in 1.2.3.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
reconurge · flowsintCVEs relacionadas — reconurge flowsint
No mesmo produto, das mais perigosas para as menos.
CVE-2026-32311CRITICALCommand Injection and Docker container escape allows root on host machineEPSS 0.5%CVE-2026-42156HIGHFlowsint: Cypher query injection in node type on node creationEPSS 0.3%CVE-2026-44352MEDIUMFlowsint: Broken Access Control allows reading of sketch logs from any userEPSS 0.3%CVE-2026-42158LOWFlowsint: Broken Access Control allows modification of investigation metadata from any userEPSS 0.2%CVE-2026-42159MEDIUMFlowsint: Stored XSS in description of nodeEPSS 0.2%