Cross-Site Scripting Vulnerability in SHIRASAGI Product by SS Project
CVE-2026-117679

5.1MEDIUM

Key Information:

Vendor

Shirasagi Project

Status
Shirasagi
Vendor
CVE Published:
5 November 2026

What is CVE-2026-117679?

An authentication-based cross-site scripting vulnerability has been identified in the SHIRASAGI web application. This security flaw allows an authenticated attacker to inject arbitrary scripts into a user's web browser when they visit a website utilizing the affected product. If successfully exploited, this can lead to unauthorized actions or data exposure. Users are encouraged to implement necessary security measures and update their systems to mitigate potential risks associated with this vulnerability.

Affected Version(s)

SHIRASAGI v1.12.0

References

https://www.ss-proj.org/support/1743.html
https://jvn.jp/en/jp/JVN55454512/

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

CVSS V3.0

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.