Stored Cross-Site Scripting Vulnerability in Chargemap by Praksokchea

CVE-2026-67177

What is CVE-2026-67177?

Chargemap is susceptible to a stored cross-site scripting (XSS) vulnerability that can be exploited by a remote, unauthenticated attacker. By injecting malicious code into the username field of the account registration page, attackers can create a new account linked to a victim's email address. Once this is done, the attacker may initiate a password reset request, leading to the code executing in the victim's browser when they interact with the link. This highlights the importance of securing user input fields to prevent such attacks.

References