CVE-2026-10234

LOW

Mettle sendportal Campaign webview cross site scripting

Title source: cna
STIX 2.1

Description

A vulnerability was detected in Mettle sendportal up to 3.0.1. This affects an unknown part of the file /webview/ of the component Campaign Handler. The manipulation of the argument content results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

References (7)

Core 7
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-367513 | Mettle sendportal Campaign webview cross site scripting
https://vuldb.com/vuln/367513
Signature, Permissions Required signature permissions-required
VDB-367513 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/367513/cti
Third Party Advisory third-party-advisory
CVE-2026-10234 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-10234
Third Party Advisory third-party-advisory
Submit #822923 | Mettle sendportal v3.0.1 Cross Site Scripting
https://vuldb.com/submit/822923
Third Party Advisory third-party-advisory
Submit #825494 | mettle sendportal 3.0.1 Cross Site Scripting (Duplicate)
https://vuldb.com/submit/825494
Exploit exploit issue-tracking
https://github.com/mettle/sendportal/issues/338

Scores

CVSS v3 3.5
EPSS 0.0020
EPSS Percentile 10.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-94
Status published
Products (2)
Mettle/sendportal 3.0.0
Mettle/sendportal 3.0.1
Published Jun 01, 2026
Tracked Since Jun 01, 2026