GitHub Advisoryadvisory · Packagist
GHSA-wrcg-234w-hfhq Subrion CMS vulnerable to Cross-site Scripting
LOW
Official page ↗
- Aliases
- CVE-2026-12202
- Ecosystem
- Packagist
- Packages
- intelliants/subrion
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2026-08-25
Affected packages
• Packagist intelliants/subrion: <= 4.0.3 (no fix yet)
Description
A vulnerability has been found in Intelliants Subrion CMS up to 4.0.3. Affected by this issue is some unknown functionality of the component Blocks Endpoint. Such manipulation of the argument CSS class name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Related
Alias · CVE (1)
- CVE-2026-12202 A vulnerability has been found in Intelliants Subrion CMS up to 4.0.3. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-12202 advisory
- https://github.com/intelliants/subrion package
- https://hackmd.io/@noka/B1sue5Xkzl web
- https://karinagante.github.io/cve-2026-12202 web
- https://karinagante.github.io/cve-2026-12202/#proof-of-concept-poc web
- https://vuldb.com/cve/CVE-2026-12202 web
- https://vuldb.com/submit/830013 web
- https://vuldb.com/vuln/370845 web
- https://vuldb.com/vuln/370845/cti web