CVE-2026-13558

LOW

CodeAstro Complaint Management System Report addreport cross site scripting

Title source: cna

Description

A security flaw has been discovered in CodeAstro Complaint Management System 1.0. This issue affects some unknown processing of the file /report/addreport of the component Report Handler. Performing a manipulation of the argument Report Title results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

References (6)

Core 6

Core References

Product product

https://codeastro.com/

Vdb Entry, Technical Description vdb-entry technical-description

VDB-374566 | CodeAstro Complaint Management System Report addreport cross site scripting

https://vuldb.com/vuln/374566

Signature, Permissions Required signature permissions-required

VDB-374566 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/374566/cti

Third Party Advisory third-party-advisory

CVE-2026-13558 | CVE Analysis and Report

https://vuldb.com/cve/CVE-2026-13558

Third Party Advisory third-party-advisory

Submit #843714 | CodeAstro Complaint Management System v1.0 Stored Cross-Site Scripting (XSS)

https://vuldb.com/submit/843714

Exploit exploit

https://github.com/ashikmd0507/CVE/blob/main/Stored%20XSS%20in%20Report%20Title%20Field%20Allows%20Script%20Execution%20in%20Admin%20Panel/README.md

Scores

CVSS v3 3.5

EPSS 0.0020

EPSS Percentile 9.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79 CWE-94

Status published

Products (1)

CodeAstro/Complaint Management System 1.0

Published Jun 29, 2026

Tracked Since Jun 29, 2026