Stored XSS Vulnerability in Cervantes Checklists from Grayback
CVE-2026-115993

6.8MEDIUM

Key Information:

Vendor

Cervantessec

Status
Cervantes
Vendor
CVE Published:
24 October 2026

What is CVE-2026-115993?

A stored XSS vulnerability exists in the 'Notes' field of the Checklists feature in Cervantes version v1.3-beta. This security flaw could enable an attacker to inject malicious scripts that are stored and executed in the context of another user's browser, potentially allowing for unauthorized access and elevated privileges. Users of Cervantes are urged to review their current implementations and apply relevant security patches to mitigate this risk.

Affected Version(s)

cervantes alpha 0.3 <= 1.3-beta

cervantes v.1.4.0-beta

References

https://www.grayback.es/advisories
patch
https://www.grayback.es/en/advisories
patch

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Manuel MartĂ­nez Casasola
.