Cross Site Scripting Vulnerability in XBackBone by Sergix44
CVE-2026-129267

5.1MEDIUM

Key Information:

Vendor

Sergix44

Status
Xbackbone
Vendor
CVE Published:
14 November 2026

What is CVE-2026-129267?

A vulnerability exists in the MediaController::getRawById function of the XBackBone application by Sergix44, allowing for cross site scripting (XSS) attacks. This flaw can be exploited remotely, enabling attackers to inject malicious scripts into web pages viewed by users. With the exploit already made public, it poses a significant security risk until the proposed patch is accepted and deployed.

Affected Version(s)

XBackBone 3.8.0

XBackBone 3.8.1

XBackBone 3.8.2

References

https://vuldb.com/vuln/437311
vdb-entrytechnical-description
https://vuldb.com/vuln/437311/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-129267
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

joshyuan (VulDB User)
VulDB CNA Team
.