CVE-2026-15321

LOW

MyEMS Admin Backend svg.py on_post cross site scripting

Title source: cna
STIX 2.1

Description

A vulnerability was found in MyEMS up to 6.4.0. The affected element is the function on_post of the file myems-api/core/svg.py of the component Admin Backend. The manipulation of the argument new_values['data'] results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used. Upgrading to version 6.5.0 is sufficient to fix this issue. The patch is identified as 4a97edfbd786c779d0322054833b21ddf54d5b06. It is suggested to upgrade the affected component. The issue report remains open even though there is an official fix for it.

References (8)

Core 8
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-377263 | MyEMS Admin Backend svg.py on_post cross site scripting
https://vuldb.com/vuln/377263
Signature, Permissions Required signature permissions-required
VDB-377263 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/377263/cti
Third Party Advisory third-party-advisory
CVE-2026-15321 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-15321
Third Party Advisory third-party-advisory
Submit #853060 | MyEMS <=6.4.0 Cross Site Scripting
https://vuldb.com/submit/853060
Exploit exploit issue-tracking
https://github.com/MyEMS/myems/issues/412

Scores

CVSS v3 2.4
EPSS 0.0022
EPSS Percentile 12.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-94
Status published
Products (6)
None/MyEMS 6.0
None/MyEMS 6.1
None/MyEMS 6.2
None/MyEMS 6.3
None/MyEMS 6.4.0
None/MyEMS 6.5.0
Published Jul 10, 2026
Tracked Since Jul 10, 2026